Chainalysis has confirmed that attackers who breached its systems in October stole usernames, password hashes, and live authentication tokens—a more severe compromise than the previously disclosed leak of user IDs, names, emails, and role labels. After detecting anomalous activity on its transaction screening products, the company shut down the login pages for Reactor, Data Solutions, and KYT, and plans to restore KYT and address screening services on November 5. All users need to reset their passwords and rotate API keys as needed. Chainalysis described the breach as a path attack (man-in-the-middle attack), suggesting that the attackers used AI agents.