Chainalysis breach: What to reset and what to revoke

Chainalysis has told customers to reset their passwords and rotate API keys. According to its incident notice, that doesn’t cover everything: live tokens for all users were exposed too, and a password reset does not cancel a token that was already issued.

The notice has also changed since it was first published. On 30 Oct it said there was no indication that session tokens were accessed. The 4 Nov update also lists names, usernames and password hashes.

Token revocation is the act of cancelling a token so that it stops working before its expiry time. A token is a credential that proves an earlier login or grants API access without sending the password again, so whoever holds a working token can act as its owner until the token expires or is revoked.

What happened in the Chainalysis breach

For a customer, Chainalysis is a vendor that holds their logins and tokens for its service, the kind of third-party exposure covered in third-party access risk. The company keeps a running log of the incident on one page, last updated on 10 Nov, when Data Solutions came back online. The 30 Oct notice described the data accessed as non-sensitive: user IDs, full names, email addresses and role labels.

On 4 Nov the company first described an "on-path attack" that exposed customer passwords. An update at 23:00 EST that day added password hashes and live tokens for all users. An on-path attack (formerly called man-in-the-middle) places an attacker between two systems so that traffic passes through the attacker. The timeline below comes from Chainalysis's incident notice, with times as the company states them (US Eastern, EST).

Chainalysis also says it is directly notifying customers whose KYT accounts "appear to have been accessed without authorization". An exposed token is a risk. An accessed account is an event. The checklist below covers the token side — an accessed account needs its own investigation.

Chainalysis says it has no evidence that investigations data was accessed or that attribution data was manipulated. American Banker reports that the company has not said how long an intruder had access or when customers learned of the token exposure.

Chainalysis has also not said what kind of "live tokens" were exposed, or defined the term. In general, a live token is one that has neither expired nor been revoked, so it still works. The 30 Oct notice said "session tokens" and the 4 Nov update says "live tokens". They may be the same thing, but the company hasn't said.

Our advice: treat a vendor's first all-clear as provisional. If a vendor says tokens or keys may have been exposed, revoke and rotate them now and investigate afterwards. Re-read the vendor's incident page every day until it says the investigation is closed. Chainalysis's own page changed between 30 Oct and 4 Nov.

Password reset vs. token revocation: What each one fixes

A password reset and token revocation close different doors. A reset replaces the password, and with it the stored hash. Revocation cancels credentials issued earlier: sessions, refresh tokens, access tokens and API keys. Two-factor sign-in protects the login step, and a token is issued after that step, so the two jobs have different owners and different clocks.

Microsoft's documentation and NIST's guidance confirm the split. Microsoft Learn says that "Microsoft Entra ID can't directly revoke a session token issued by an application". Its "Revoke sessions" action ends the user's refresh tokens, so the user can't get new tokens, but access tokens already issued work until they expire (by default, 1 hour) unless the application supports continuous access evaluation, which lets the service reject a token before it expires when a revocation event occurs. NIST SP 800-63B-4, Sec. 5.1 (Access Tokens), notes that access tokens and refresh tokens "could be valid long after the authentication session has ended".

SpyCloud, a security vendor, reports that AI-tool tokens, API keys and session cookies stolen by infostealer malware often survive a password reset.

Holding a token usually lets an attacker skip the sign-in step, but not always: some services bind sessions to a device, ask for fresh authentication before sensitive actions, or check risk continuously.

Our advice: do both halves.

Passwords. If you use Chainalysis, reset your password when it grants you access, through its login page directly rather than email links, as its 4 Nov email advises. Because an on-path attack exposed customer passwords, also change any other account that shares the same or a similar password. Make each new password unique and long and random, generated in a password manager rather than built from a memorable phrase or a variation of an old password.

Tokens. If a provider's revoke action leaves access tokens working until they expire, treat that gap as an open window. Look up the longest time an already-issued token can keep working, and don't consider the incident closed until it has passed.

How long does a stolen token stay usable?

As long as the shortest of three things allows: its expiry, your ability to revoke it, and the issuer's willingness to disable it. The figures below show how wide the range is.

Truffle adds a comparison. When Google relied on notifying owners of leaked Google Cloud keys, 72% of exposed keys still worked. After Google began disabling leaked keys by default, the figure was 11%, according to Truffle. In that case, revocation built into the issuer worked better than an email.

You can't control how fast a vendor discloses. You can control the lifetime of the tokens you issue, and how quickly you can cancel the ones you hold.

Our advice: rank your tokens by how long each could stay usable if it leaked today, and deal with the longest first. A key with no expiry and no tested revoke call goes to the top of the list, because nothing limits it except the issuer's own disabling.

The token revocation checklist: Five controls for live tokens

Use this when a vendor says tokens were exposed, and as a drill before it happens. A password manager is a sensible home for the inventory in control 1: Passwork stores API keys and tokens next to team passwords, under the same access levels.

1. Keep a token inventory before you need one. List every API key, access token, refresh token and service account: owner, issuer, scope, expiry, and where it is revoked. A vendor notice is a bad moment to learn that nobody knows which keys the vendor holds.
2. Write down and test the revoke call for each issuer. Providers differ. In Microsoft Entra, revoking sessions ends refresh tokens but not access tokens already issued. Test the call in a non-production tenant, and record what still works afterwards. The secrets rotation lifecycle explains why revocation and rotation are different steps.
3. Shorten lifetimes to what the job needs. Use the NIST limits above as a reference for user sessions, and tie machine tokens to the length of the job. Passwork's guidance for CI/CD service accounts is an access token of 15 to 60 minutes and a refresh token of 1 day, covered with other token rules in the AI agent credentials guide.
4. Revoke first, then reset and rotate. Cancel sessions and tokens at the issuer, rotate API keys, then reset passwords and change reused ones. Chainalysis's own sequence added a step: customers were asked to send trusted IP addresses for an allowlist, then to reset passwords and rotate API keys once access was granted. For environment variables and AI keys, see what to rotate after the Northflank breach.
5. Limit where a token can be used, and watch it after exposure. Where the provider supports it, allowlist IP addresses for API tokens and bind sessions to a device or network. NIST SP 800-63B-4 also advises against keeping session secrets in browser local storage. SpyCloud's advice is to review unusual API consumption, so alert on volume spikes.

How Passwork helps with token revocation

Passwork's documented capabilities map to the five controls as follows. A password manager shows which records hold a token and who has access to them. Cancelling a token still happens at the issuer, whichever tool holds the inventory.

Where to start with token revocation

Pick the tokens and keys with the widest reach: cloud admin, CI/CD, a data or payments API, an AI provider key and a SaaS admin token. For each one, write down the owner, the place it is revoked, and the exact revoke call. Then run one timed drill: how many minutes does it take from "a vendor says tokens were exposed" to "every token on the list is revoked or replaced"?

Write your order of operations down before a notice arrives. If your tokens already sit in a password manager with access levels and an activity log, the job becomes a list instead of a search.

Frequently Asked Questions

Northflank breach: What to rotate after the incident

Northflank told customers to assume every environment variable was decrypted. Railway warned some may have been, and Huntress tracked stolen M365 tokens replayed at 79 organizations. What each disclosed, and what to rotate.

PassworkPasswork Team

LiteLLM supply chain attack, Zeabur breach, Gheist: Unrevoked credentials

A key leaked in May helped poison a release in October. Five recent incidents, from LiteLLM to Zeabur, show what happens when credentials outlive their purpose.

PassworkAlex Muntyan

NIST password guidelines 2026: What SP 800-63B-4 requires

Eight characters, a required symbol, a new password every 90 days: SP 800-63B-4 rules out all three for password-only sign-in. Here is what NIST's final standard requires, and a four-part check to run against your live system.

PassworkPasswork Team