Chainalysis says an investigation into an attack on its systems has found that names, usernames, password hashes and live tokens for all users were exposed, The Hacker News reported on November 6. The blockchain analysis company has restricted access to several services and says users will need to reset passwords and, where appropriate, rotate API keys as access returns.
The latest disclosure expands the credential exposure beyond the subset of customer passwords the company previously reported. Password hashes are stored representations of passwords; live tokens are credentials used to authorize access. Chainalysis has locked impacted accounts and taken its Know Your Transaction (KYT) user interface and API, other address screening products, and login page offline. It also removed access to Reactor and Data Solutions during the investigation.
Chainalysis said it continued to have no evidence that investigation data had been accessed or that its attribution data—the information used to associate blockchain activity with entities—had been manipulated. It has added monitoring to detect unusual activity.
Wider exposure emerges during investigation
The update comes less than a week after Chainalysis disclosed that an external actor had gained unauthorized access to its systems and internal tools. The company described an ongoing attack across multiple fronts involving “offensive agentic techniques,” meaning AI agents used to carry out attack tasks.
During its investigation, Chainalysis identified what it called an “on-path attack,” in which an attacker intercepts communications, exposing some customer passwords. The company said it had addressed that attack vector. The attacker’s identity remains unclear; Chainalysis described the incident as similar to attacks against other technology platforms in recent weeks.
Customers who received password-reset emails could not immediately complete the reset while access was restricted. Chainalysis encouraged them to change passwords on other systems wherever they had reused those credentials.
AI agents pursue cloud credentials
The Hacker News placed the incident alongside disclosures from Chainstack, OpenCode, Warp and WorkOS about AI-driven attacks, some involving ARTEX, an autonomous penetration-testing tool. Those reports provide context for Chainalysis’s description of the attack, without establishing that the same actor or tool was responsible.
Microsoft’s findings, as reported by The Hacker News, describe an agentic AI offensive framework searching public GitHub repositories for exposed secrets, including application credentials and API keys for AI services. The agents can analyze search results and carry out subsequent attacks, reducing the manual work required from an operator.
In at least one reported case, an agent moved from searching GitHub for secrets to extracting data from Azure Key Vault, Microsoft’s cloud service for storing secrets, in five minutes. Microsoft assessed the activity as ongoing since August 2026.
Parts of that campaign involved valid application credentials being used to access organizations’ Microsoft Entra ID identity environments and connected Azure and Microsoft 365 resources. Sign-ins originated from 199.19.77[.]84 and 199.19.77[.]18. Microsoft said an agent successfully signed in as application identities, known as service principals, across dozens of associated applications in multiple organizations’ environments.
The attacker sought operations that return credentials: storage account keys, App Service settings, connection strings, publishing credentials, AI and machine-learning connections and datastores, and Azure Kubernetes Service user credentials. Compromised applications subsequently accessed SharePoint and OneDrive, with activity including file downloads and mailbox-item access.
Microsoft also observed attempts to steal Azure resources, including compromised Azure AI services, likely to support broader attacks. Agents obtained tokens for OAuth applications restricted to a single organization, then used those compromised applications to list other cloud resources. In a handful of cases, they extracted secrets from Azure Key Vault.
The agents repeatedly sought credentials for AI services, Microsoft said, including major providers’ API keys and OAuth applications with access to Foundry Tools, previously known as Azure Cognitive Services.
Stolen AI access becomes a resale business
The broader activity coincides with a rise in attacks against AI developer platforms over the past month. The reported uses include reselling access, consuming victims’ computing resources through “LLMjacking,” and using compromised infrastructure to obscure the source of further attacks.
In findings published this week, Google described criminals stealing cloud access to commercial large language models and selling it to paying customers. Intermediaries called “LLM mixers” route subscribers’ requests through compromised enterprise accounts, distribute consumption across those accounts and obscure where access originated. Buyers can use the models without establishing their own legitimate API credentials or cloud infrastructure.
Google-owned Wiz said this resale market makes stolen access readily monetizable and likely encourages further credential theft. It identified at least two operations using stolen AWS Bedrock keys from two different organizations: llm-routing[.]com, also called momo, and xingjiabiapi[.]org. Both advertised discounted access to a wide selection of frontier models, though there was no evidence their operators carried out the initial compromises.
An IP address associated with llm-routing[.]com, 23.106.46[.]239, hosted an Artex landing page in mid-October 2026 and was flagged by Zeabur as an indicator of compromise. Zeabur disclosed last month that an unknown attacker had exploited plaintext credentials to compromise its infrastructure and extract more than 3.2 million environment-variable records and data associated with 321,810 accounts.
The report listed four IP addresses used to test stolen keys and suspected of links to LLM token abuse and resale:
23.106.46.23938.246.114.118104.243.32.5031.57.201.201
Wiz said attackers were also compromising environments specifically to fund large-scale model use at victims’ expense, generating hundreds of thousands of dollars in AI API charges.
Chainalysis outlines the route back to service
Chainalysis said it intended to begin restoring KYT and Address Screening access. Customers should provide trusted IP addresses to [email protected] or their account team so the company can add them to an allowlist—a list of permitted network addresses. Users can then reset passwords and rotate API keys to register transactions.
The company said work continued to harden its systems and restore Reactor and Data Solutions. It plans additional account protections and will require every user to reset their password and rotate API keys where appropriate, with further access changes to be communicated to customers.
