[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-chainalysis-says-hackers-took-hashes-and-tokens-for-all-users":10,"sections":49},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":38,"tags":39,"sources":44,"feedback":48,"feedback_at":22,"cost_usd":48,"total_tokens":48},12401,"chainalysis-says-hackers-took-hashes-and-tokens-for-all-users","Chainalysis Says Hackers Took Hashes and Tokens for All Users","Chainalysis said October intruders took password hashes and live tokens for every user, with customers including the FBI and Microsoft.","Chainalysis, the blockchain analysis firm, said attackers who breached its network in October obtained names, usernames, password hashes and live tokens for all of its users.\n\nThe company said an external actor used AI agent-assisted offensive techniques, meaning automated software that carries out steps of an attack, to get into Chainalysis systems and internal tools. It described the incident as similar to hacks of other platforms during the same month. Separately, an email to affected customers said \"non-sensitive customer data, such as user IDs, full names, email addresses, and organization role labels for users provisioned on our platform were accessed.\" It is not clear why the company called that information non-sensitive.\n\nTwo of the stolen items deserve a plain definition. A password hash is a scrambled version of a password, which an attacker can try to crack offline. A live token is a digital key that proves a user is already logged in, and one that still works can often be used without knowing the password at all. Tokens are the more urgent problem, since they can work immediately.\n\nThe customer list raises the stakes. Chainalysis and public sources have named the FBI, US Immigration and Customs Enforcement, the US Air Force, Microsoft, Coinbase and Barclays among its users. It is unclear whether the theft exposed those customers to further threats.\n\nThe tool is built to trace crypto transactions, so a roster of who has accounts, and what roles they hold, is useful to anyone interested in who is investigating whom. That is inference, not something the company has said. It also makes the \"non-sensitive\" label for names and role labels harder to defend.\n\nThe larger question is how an attack that leans on AI agents compares with the intrusions of earlier years. Nothing here says it was faster or cheaper than a conventional break-in, and the company has not published a timeline.","[\"chainalysis\",\"data-breach\",\"credentials\",\"ai-agents\"]","2026-11-06T20:56:41.000Z","2026-11-08T00:26:19.410Z","2026-11-08T00:26:19.606Z","published",null,[24,30,34],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Replace the meta-text \"nothing in the available material explains why the company chose the label\" with a plain statement that Chainalysis hasn't explained it, and clarify who said password hashes and live tokens were taken (the lead credits Chainalysis, but the only quoted company statement lists neither, and \"the broader account of the theft\" is an unnamed source), also dating the disclosure instead of leaving it vague.","resolved",{"id":31,"reviewer":26,"round":32,"reason":33,"status":29},"editor-r2",2,"The draft still does not say who claimed hashes and live tokens were stolen (\"the fullest account\" and \"the broader claim\" are unnamed; the source, Ars Technica, attributes it to Chainalysis, so either credit that or explain the discrepancy), and the \"October 30\" disclosure date is not in the source, which only says \"last Friday\", so either verify and source the date or remove it.",{"id":35,"reviewer":26,"round":36,"reason":37,"status":29},"editor-r3",3,"The draft still leaves the source of the hashes-and-tokens claim muddy: the lead credits Chainalysis, the dek implies the customer email listed hashes and tokens as non-sensitive when the quoted passage lists only user IDs, names, emails and role labels, and the line 'Nor is it clear whether the email mentioned the hashes and tokens at all, since only that one passage is quoted' is meta-text about missing source material. Fix this by attributing the hashes-and-tokens claim to Chainalysis's discl","security",[40,41,42,43],"chainalysis","data-breach","credentials","ai-agents",[45],{"name":46,"url":47},"Ars Technica","https:\u002F\u002Farstechnica.com\u002Fsecurity\u002F2026\u002F11\u002Fchainalysis-says-hackers-stole-credentials-and-tokens-for-all-of-its-customers\u002F",0,{"sections":50},[51,56,60,65,70,75,80,85,90,95,100,105,110,115],{"name":52,"slug":53,"count":54,"latest_published_at":55},"AI","ai",7110,"2026-11-08T14:34:09.000Z",{"name":57,"slug":38,"count":58,"latest_published_at":59},"Security",1099,"2026-11-08T15:24:01.000Z",{"name":61,"slug":62,"count":63,"latest_published_at":64},"Deals","deals",620,"2026-11-08T08:00:00.000Z",{"name":66,"slug":67,"count":68,"latest_published_at":69},"Policy","policy",604,"2026-11-07T15:48:26.000Z",{"name":71,"slug":72,"count":73,"latest_published_at":74},"Consumer Tech","consumer-tech",336,"2026-11-08T21:00:00.000Z",{"name":76,"slug":77,"count":78,"latest_published_at":79},"Hardware","hardware",316,"2026-11-08T14:36:39.000Z",{"name":81,"slug":82,"count":83,"latest_published_at":84},"Science","science",222,"2026-11-07T16:19:17.000Z",{"name":86,"slug":87,"count":88,"latest_published_at":89},"Software","software",154,"2026-11-08T15:42:52.000Z",{"name":91,"slug":92,"count":93,"latest_published_at":94},"Startups","startups",150,"2026-11-06T16:50:01.000Z",{"name":96,"slug":97,"count":98,"latest_published_at":99},"Dev Tools","dev-tools",125,"2026-11-06T22:15:59.000Z",{"name":101,"slug":102,"count":103,"latest_published_at":104},"General","general",111,"2026-11-08T21:27:29.000Z",{"name":106,"slug":107,"count":108,"latest_published_at":109},"Gaming","gaming",94,"2026-11-08T20:52:05.000Z",{"name":111,"slug":112,"count":113,"latest_published_at":114},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":116,"slug":117,"count":118,"latest_published_at":119},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]