1. Chainalysis breach: phased restoration begins
Chainalysis began restoring its KYT transaction-monitoring service and Address Screening tool on Friday, November 6, in phases, following a breach first disclosed on October 30. The blockchain analytics firm said password hashes for all users were exposed, so every customer must reset a password and, where relevant, rotate API keys before registering transactions again.
The restoration is gradual by design. Chainalysis said it will admit additional customers as each phase is verified, rather than switching everything on at once. The company posted the latest step in a running incident log that now holds six dated entries, the most recent timestamped 3:30 a.m. Eastern time on Friday.
For compliance teams at exchanges, banks and payment firms that depend on these tools to screen deposits and withdrawals, the update is the first concrete sign that normal operations are returning after more than a week of disruption.
2. What customers must do before access returns
Customers that have not yet supplied trusted IP addresses must do that first. Chainalysis is placing the reopened tools behind IP allowlists, meaning only traffic from addresses a customer has pre-approved can reach the services. The measure narrows the set of locations from which anyone, including an intruder holding stolen credentials, could connect.
Once access is granted, each user has to set a new password. Customers must also rotate API keys where applicable before they register transactions. API keys let a customer's own systems send transactions to KYT automatically, so a key that may have been exposed would otherwise remain a potential way in.
Two other products remain offline. Reactor, the investigation tool, and Data Solutions have not been brought back. Chainalysis said outside security experts are helping it harden its systems before those services return, and it did not give a date for either.
3. What did Chainalysis say was exposed?
Chainalysis said late on Wednesday, November 4, that password hashes and what it called live tokens belonging to all users had been exposed to an attacker. A password hash is a scrambled form of a password that a service stores instead of the password itself; it is harder to abuse than a clear-text password, but it can still be attacked offline if the hashing is weak or the password is simple.
The company said it found the all-users exposure the previous Monday, November 2. It also said it was contacting KYT customers whose accounts showed signs of unauthorized access. Chainalysis has not said how many KYT accounts were accessed, and it has not stated how many users it has in total.
The term live tokens was not defined in the update. Tokens in this context usually refer to credentials that keep a session or integration authenticated, which is why the instruction to rotate API keys and reset passwords applies to everyone rather than only to accounts flagged as accessed.
4. How the disclosures widened over six updates
The incident log has grown steadily since the first notice. On October 30, Chainalysis published its first post and sent customers an email describing an outside intrusion into internal systems and tools. That email classified user IDs and email addresses as non-sensitive customer data.
On November 2, the firm pulled Reactor and Data Solutions as a precaution while transaction monitoring kept running. On November 4 at 9:50 a.m., it emailed certain customers whose passwords had leaked in what it called an on-path attack, and locked their accounts until the passwords were reset.
Forty minutes later, at 10:30 a.m., Chainalysis took down the KYT interface and API, its other address-screening products and the login page after detecting abnormal activity. At 11 p.m. that night it disclosed the exposure affecting all users. The sixth entry, on Friday morning, began the phased return of KYT and Address Screening.
Reporting on November 2 had indicated that no session tokens, clear-text passwords or multi-factor authentication secrets had been reached at that stage. The later disclosures show how the picture changed as the investigation continued.
5. Is investigations data at risk?
Chainalysis said its Wednesday-night entry contained no evidence that investigations data had been accessed, and none that attribution data had been manipulated. Attribution data links blockchain addresses to real-world entities such as exchanges, mixers or sanctioned groups, and it underpins how clients decide whether a counterparty is risky.
That statement matters because tampering with attribution labels could cause screening tools to clear dangerous addresses or flag harmless ones. The company's position is that it has seen no sign of that, though the absence of evidence is not a final finding while the investigation with outside experts is still under way.
Customers that use the tools for law enforcement support or regulatory reporting will likely want written confirmation of the scope of any access, a point the company has not yet addressed in detail.
6. Why the breach matters for crypto compliance
Chainalysis supplies monitoring and investigation software to exchanges, financial institutions and government agencies. KYT, short for know your transaction, screens transfers against known risk categories as they happen, while Address Screening checks a wallet before a firm interacts with it. When these services go down, firms must either pause activity or rely on manual processes.
A security incident at a compliance vendor also creates a second-order concern. Customers hand such a provider sensitive operational data, including the transactions they submit for review, and they place their own API credentials in its systems. Compromised credentials at the vendor can therefore become a risk for each client.
The decision to require IP allowlisting reflects that concern. It adds a network-level control on top of passwords, so that a stolen login on its own is no longer enough to reach the reopened services.
7. How do password hashes and on-path attacks work?
A password hash is the output of a one-way mathematical function applied to a password. Services store the hash so that they can check a login attempt without keeping the password itself. If an attacker obtains a set of hashes, they can try large numbers of guesses offline and compare the results, which is why simple or reused passwords are the most exposed.
An on-path attack, sometimes called a man-in-the-middle attack, occurs when a party positions itself between a user and a service and can read or alter the traffic passing between them. Chainalysis used that label for the incident affecting certain customers on November 4, and it locked those accounts until the passwords were reset.
Resetting a password makes any previously captured hash useless for logging in, and rotating an API key replaces a credential that may have been copied. Together with allowlisting, these are standard containment steps after a credential exposure, because they invalidate what an intruder may already hold rather than relying on proof that nothing was taken.
Users who reused the same password at other services would normally be advised to change it there as well, since a leaked hash that is cracked can be tried against other accounts. Chainalysis has not issued guidance on that point in the latest entry.
8. What KYT and Address Screening actually do
KYT reviews transactions as a customer's systems submit them. A firm sends a deposit or withdrawal, the service compares the counterparties against its database of labeled addresses and exposure categories, and it returns an alert score so that compliance staff can approve, hold or investigate the transfer. Because this happens through an API, outages can interrupt automated workflows directly.
Address Screening works at an earlier point, checking a single wallet address for links to sanctioned entities, illicit services or other high-risk groups before a firm accepts funds or sends them. Both tools support anti-money-laundering and sanctions-compliance duties, which regulators expect regulated businesses to perform continuously.
Reactor, by contrast, is used for investigations: analysts trace the movement of funds across addresses and services. Its continued absence affects teams that rely on it for case work, but it does not interrupt the real-time screening that exchanges run on every transfer.
9. What should compliance teams weigh in the meantime?
Firms that depend on the tools face a practical choice while phases roll out. Some will wait for access to be restored to their account, while others may lean on alternative screening providers or manual review for higher-risk transfers. Which path is sensible depends on transaction volume, jurisdiction and internal policy, and the update does not prescribe either.
Security teams, for their part, will usually review which staff hold credentials to the service, confirm that API keys are stored in a secrets manager rather than in code, and check logs for unexpected requests during the affected period. Chainalysis has said it is contacting KYT customers whose accounts showed signs of unauthorized access, so firms that have not heard from the company may reasonably infer that no such signs were found on their accounts, though the firm has not stated that explicitly.
The episode is also a reminder that vendors in the compliance chain are part of a customer's attack surface. Contracts and risk assessments for such providers often include notification timelines and security-audit rights, and incidents of this kind tend to prompt customers to revisit them.
10. What comes next
The immediate steps are in the customers' hands: submit trusted IP addresses, reset passwords, rotate API keys, and then wait for their phase of the restoration. Chainalysis has said it will add customers as verification proceeds, but it has not set a schedule for completing the process.
Several questions remain open. The company has not disclosed how many KYT accounts were accessed without authorization, has not defined live tokens, and has given no return date for Reactor or Data Solutions. Further entries in the incident log are likely to address them as the investigation, supported by external security specialists, continues.