The incident affected account-level information
Chainalysis reported on 4 November that names, usernames, password hashes and live tokens for its users had been exposed to a malicious actor. It took products offline while working with external security specialists and notifying customers whose accounts appeared to have been accessed without authorisation.
The company invalidated sessions and required password resets. Customers were also instructed to rotate API keys and submit trusted IP addresses for an allowlist before restoring automated connections.
Restoration is being completed in phases
KYT and Address Screening are used by exchanges and compliance teams to review transaction risk. Chainalysis began returning access in phases on 6 November so it could validate new controls before expanding availability.
On 7 November, the company said Reactor, the KYT interface and API, and Address Screening were back online. The latest update therefore replaces the earlier phased-restoration status, although customers still have to follow the reconnection instructions sent by email.
| Confirmed item | Current status or response |
|---|---|
| Reactor | Back online with enhanced security measures |
| KYT UI and API | Back online; password reset and API-key rotation required |
| Address Screening | Back online through the controlled reconnection process |
| Exposed account information | Names, usernames, password hashes and live tokens reported |
| Investigation and attribution data | No evidence of access or manipulation reported |
The company separated exposed accounts from investigation data
Chainalysis says it has found no evidence that investigation data was accessed or that its attribution data was manipulated. It also states that the incident is unrelated to the recent crypto theft involving Binance.
Those findings do not remove the need for account-level checks. A live token or reused password can create risk even when case records remain unchanged, so organisations should compare recent activity with their own audit logs.
Customers need to finish their own checks
A password reset is only one part of recovery. Teams should rotate API keys before registering transactions, remove unused accounts, confirm multi-factor authentication and restrict each credential to the minimum permissions required.
Compliance teams should also document the period in which automated products were unavailable. Transactions processed during the interruption may need a later review under the organisation’s own procedures, even though the Chainalysis services are now online.
This article is for information only and is not investment advice.
admin_wcContributor · World-CryptMore from
