Chainalysis Breach: Why "Non-Sensitive" Is the Wrong Word

On the evening of October 30, 2026, Chainalysis published a notice. An "external actor using offensive agentic techniques" had gotten into its systems and internal tools. What was accessed, it said, was "non-sensitive": "user IDs, full names, email addresses, and organization role labels for users provisioned on our platform."

Chainalysis sells blockchain investigation and compliance software to "over 1,500 organizations." Its site lists law enforcement, national security, tax agencies, regulators, exchanges and financial institutions among them. So a list of its users is, in large part, a list of the people who investigate crypto crime and the compliance teams who screen it.

We read the notice against Chainalysis's own documents, three U.S. breach laws and the EU rules. "Non-sensitive" is legally defensible. It's still the wrong word for a list like this.

What we found

• The fields are personal data by Chainalysis's own definition. Its privacy notice lists "Agent and End User Data, including any email addresses and names" and "Business Data, such as your role" as personal data it collects. The word "sensitive" appears nowhere in that notice.
• Two-factor authentication may still be off. The email tells customers: "If your organization has not yet enabled two-factor authentication, we strongly recommend doing so." The company's Trust Center says MFA is enforced for all employees. Nothing on it says customer accounts must use it.
• The notice leaves out when, how and how many. Detection is dated "this month." The email refers to "these incidents" and says "Some of you have been previously notified." Chainalysis "declined to answer specific follow-up questions" from The Block.
• The U.S. breach laws we read don't require telling a regulator. In California and New York, an email address becomes notifiable only when a password or security answer comes with it. Texas doesn't reach email addresses at all. On October 31, none of the ten state breach registers we checked listed Chainalysis, and under these laws no filing is due.
• Three times before, "only" names and emails leaked, and scams followed. Ledger, Kroll and Coinbase all said funds, keys or passwords were safe. Ledger and Coinbase then saw targeted scams, and Kroll warned of them.

What Chainalysis said

Image: our capture of Chainalysis's notice, October 31, 2026. Highlights ours.

The notice is a short post with the customer email pasted under it. Chainalysis says it found "no indication" that investigation content, "passwords in clear text, MFA secrets, or user session tokens" were accessed, "based on the evidence available to date." It is "in the process of determining" which records were accessed for each customer, and says the breach is unrelated to the recent Binance theft.

The post went up at 21:14 UTC, and its modified timestamp is 34 minutes later. We don't know what changed: the Wayback Machine's first capture came three minutes after that, and the text hasn't changed since.

"Non-sensitive," according to whom?

Chainalysis's own paperwork never uses the word. It calls these fields personal data.

Image: our capture of Chainalysis's privacy notice, October 31, 2026. Highlights ours.

The privacy notice, last updated March 10, 2026, lists what Chainalysis collects as personal data. Two entries cover the breached fields. One is "Business Data, such as your role, company name, and website name." The other is "Agent and End User Data, including any email addresses and names or aliases of any agents or end users you authorized to log into and utilize the Service" as a Chainalysis customer.

Its EU and UK disclosures say the same, and its data processing addendum lists "User IDs" among the personal data it handles.

Then there's the two-factor line.

Image: our capture of the Chainalysis Trust Center FAQ, beside the two-factor sentence from its notice, October 31, 2026. Highlights ours.

The Trust Center answers "Do you enforce Multi-Factor Authentication (MFA) for all employees?" with "Yes." Customers get a recommendation instead: turn it on if your organization hasn't, and your account manager "can help you complete that process." The product documentation that might settle whether 2FA is optional sits behind a customer login.

Why no regulator may ever hear about it

Here "non-sensitive" does real work. The U.S. breach laws we read don't care about names and emails on their own.

Because these definitions don't reach this data, no sample notice goes to a state attorney general and nothing appears on their public lists. We checked ten of them on October 31, from California to Massachusetts, and none listed Chainalysis. It has been a day, and some registers lag by weeks, but under these statutes no filing is due at all. Chainalysis has no SEC filings of its own, so no 8-K applies. Have I Been Pwned had not loaded the data.

Europe works differently. Chainalysis's EU and UK disclosures are made under the GDPR and name the Danish data protection authority as its lead regulator. The 72-hour rule turns on risk, not sensitivity. In one of the European Data Protection Board's worked examples, an email exfiltration at a retailer, the Board says that because the data "could be used to facilitate other attacks (e.g. phishing)" the breach is "likely to result in a high risk." Whether Chainalysis told a European regulator isn't public.

What a name, work email and role label expose

This is what our readers do for a living, so we'll stick to the mechanics. We ran none of it on anyone in this dataset, and neither should you.

• The email proves where you work. The role label says what you do there. For a phisher, that's the sorting key: admins get a fake login prompt, analysts get a fake case file.
• The name finds the rest. LinkedIn's help page says outside tools can find your profile "based on your name and your organization" even with email lookup switched off.
• The address resolves to accounts. Gravatar's API is keyed on a hash of an email and serves the avatar, bio and social links tied to it. "Find my account" flows confirm whether an address is registered. Researchers have shown that a Microsoft login endpoint can reveal whether an address belongs to a tenant.
• The handle travels. Work emails follow predictable patterns, which is how Hunter.io's email finder works. The part before the @ is often reused as a username, and research from 2011 found usernames alone link "a significant portion" of profiles across sites.

An email search on Fingerprint automates that third pivot. It checks an address against supported platforms and can return the display name, avatar, bio and linked usernames each one exposes.

Three times before

• Ledger, 2020. Its e-commerce database leaked, "consisting mostly of email addresses," and Ledger said "Your payment information and crypto funds are safe." That December its CEO wrote: "many of you have been targeted by e-mail and SMS phishing campaigns." The dump held 272,000 full contact records, not the 9,532 Ledger's logs had shown.
• Kroll, 2023. A SIM swap exposed names, addresses and emails of FTX, BlockFi and Genesis claimants. Kroll's notice warned the attacker "might use this information in a further scam, for example in phishing e-mails."
• Coinbase, 2025. Bribed support agents copied names, emails, phone numbers and addresses. "No passwords, private keys, or funds were exposed," Coinbase said. Its SEC filing estimated remediation and customer reimbursements at $180 million to $400 million.

In each case the contact data wasn't the valuable part. The affiliation was: crypto owner, crypto creditor, crypto customer. Here the affiliation is crypto investigator. The closest precedent is from 2019, when hacked FBI National Academy Associates chapter sites spilled about 4,000 records on law enforcement personnel: names, emails, job titles, phone numbers and postal addresses.

If you're on the list

• Expect phishing that cites this breach. A real Chainalysis message shouldn't ask for your password or a code.
• Turn on two-factor authentication for your Chainalysis organization now.
• Check what your work email address is tied to online. Close or rename the accounts that tie your work identity to your personal one, and stop using your work handle as a username elsewhere.
• Ask Chainalysis for the per-organization breakdown it promised, and whether "user IDs" are login names.

What we still don't know

• When the intrusion was detected, and when the first customers were told.
• How many organizations and users are in the dataset.
• Whether "organization role labels" are product permissions or job titles.
• Whether hashed passwords, reset tokens or API keys were reached. The email rules out cleartext passwords, MFA secrets and session tokens. The post above it says "authentication credentials" with no qualifier.
• Whether any EU or UK regulator was notified.

FAQ

Was Chainalysis hacked?

Yes. On October 30, 2026, Chainalysis said that "this month" it had detected an "external actor using offensive agentic techniques" gaining unauthorized access to its systems and internal tools. It said it found no indication that investigation content, cleartext passwords, MFA secrets or session tokens were accessed, and that the incident is unrelated to the Binance theft.

It has not given a detection date, the way in, or the number of customers and users affected.

What data was taken in the Chainalysis breach?

Chainalysis says "user IDs, full names, email addresses, and organization role labels for users provisioned on our platform" were accessed. It calls this data "non-sensitive."

Its own privacy notice lists the names, email addresses and roles of agents and end users as personal data it collects. As of October 31, 2026, the data had not appeared on Have I Been Pwned, and Chainalysis had not said how many records were involved.

Is the Chainalysis breach a data breach under the law?

Under the U.S. state laws we read, no. California and New York require notice only when a name comes with data like a Social Security number, or when an email address comes with a password. Texas doesn't count email addresses at all. Names, work emails and role labels alone don't qualify under any of the three, so no notice has to go to a state attorney general.

Under the EU and UK GDPR, any unauthorized access to personal data is a "personal data breach." The regulator must be told within 72 hours unless the breach is unlikely to put people at risk, and European guidance counts data that could be used for phishing as a factor that raises the risk.

I use Chainalysis. What should I do?

Treat any email about the breach as a possible phishing attempt, even one that looks like it comes from Chainalysis. Don't enter your password or a two-factor code from a link.

Ask your organization's admin to turn on two-factor authentication for your Chainalysis accounts. Then check what your work email address is tied to online, and separate your work handle from your personal accounts.

Check your own work address

A roster like this doesn't need passwords to be useful. It needs a name, an address and a reason to care, and the role label supplies the reason.

If you investigate crypto crime, run your work email through a free search and see what comes back. Then fix what you find before someone else looks.