TLDR
- Chainalysis began restoring KYT and Address Screening access in phases on Friday, Nov. 6.
- The firm now says names, usernames, password hashes and live tokens for all users were exposed.
- Its first notice on Oct. 30 said only non-sensitive data like names and emails was accessed.
- All users must reset passwords and rotate API keys before using the services again.
- Reactor and Data Solutions remain offline while the company works with outside security experts.
Chainalysis has started bringing its compliance screening tools back online after a cyberattack that the company now says reached further than it first reported. The blockchain analytics firm said on Friday that it is restoring access to its KYT and Address Screening products in phases.
The restart comes one week after Chainalysis first disclosed the incident on Oct. 30. Since then, the company has posted several updates that expanded the list of exposed customer data.
Customers must take new steps before they can use the services again. Each user will need to reset passwords and rotate API keys, and organizations must submit trusted IP addresses for an allowlist.
How the Disclosure Changed Over One Week
In its first notice on Oct. 30, Chainalysis said an external actor used “offensive agentic techniques” to gain access to its systems and internal tools. The company said only non-sensitive data, such as user IDs, full names, email addresses and organization role labels, had been accessed.
At that time, Chainalysis said it found no evidence that attackers reached clear-text passwords, multi-factor authentication secrets or session tokens. It also said the incident was not related to the recent crypto theft at Binance.
🚨 Chainalysis cyberattack exposed password hashes and live tokens for all users.
The company has locked impacted accounts and taken key services offline, including KYT, Reactor, and Data Solutions.
Full details ↓ https://t.co/nBLFmq7IBu
— The Hacker News (@TheHackersNews) November 6, 2026
On Nov. 2, the company took its Reactor and Data Solutions products offline as a precaution. It kept its compliance transaction monitoring tools running, citing their role in detecting money laundering.
By Wednesday, Nov. 4, the picture had changed. Chainalysis said an “on-path attack” had exposed a subset of customer passwords, and it locked affected accounts and required password resets.
Later that day, the company said it saw abnormal activity in its screening products. It took KYT, including its user interface and API, offline along with other address screening products and its login page.
In a late Wednesday update, Chainalysis said it had discovered on Monday that names, usernames, password hashes and live tokens “for all Chainalysis users” were exposed to a malicious actor. The company also said it was directly notifying customers whose KYT accounts appear to have been accessed without authorization.
Chainalysis did not say whether every type of data was exposed for every user. The company declined to give Cointelegraph more details beyond its public posts.
What Chainalysis Says Was Not Affected
Despite the wider exposure, Chainalysis said it still has no evidence that attackers accessed its investigations data. It also said there is no sign that its attribution data was manipulated.
The company said it is working with outside cybersecurity experts and using large language models to review platform security. In its first notice, it pointed to an industry-wide rise in AI-driven cyberattacks.
Chainalysis has urged users to watch for unexpected password reset requests and authentication prompts. It told customers to go directly to its login page instead of clicking links in reset emails and recommended enabling two-factor authentication.
Users who reused their Chainalysis password on other services were advised to change it there as well. The company recommended choosing a unique password for each account.
In its Friday 3:30 a.m. EST update, Chainalysis said more customers are expected to regain KYT and Address Screening access over the next several hours. It said it is monitoring each phase and validating enhanced security controls before expanding access.
Reactor and Data Solutions remain offline. The company said it is working around the clock with external security experts to restore those products safely.
