Chainalysis has restored core products after a multi-day Chainalysis breach that began with an October incident notice and escalated into exposure of authentication material for every user. In a 7 November 2026 update timed at 1:50 p.m. EST, the company said Reactor, KYT (UI and API) and Address Screening “are now back online,” with customers asked to reconnect under enhanced controls.
The decisive disclosure came on 4 November. Chainalysis wrote that it had discovered “names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor.” It also said it continued to have “no evidence that any investigations data has been accessed or Chainalysis attribution data has been manipulated.” Customers whose KYT accounts “appear to have been accessed without authorization” were being notified directly. The company has not published a user count, and TSN is not inventing one.
Timeline of the outage and restore
The company’s incident blog, updated through 7 November, describes a sequence that started with a 30 October notice that an external actor used “offensive agentic techniques” to gain unauthorised access to systems and internal tools. Chainalysis said then that the incident was “not related to the recent crypto theft at Binance.”
On 2 November it took Reactor and Data Solutions offline while keeping compliance screening products running under monitoring. On 4 November, after the password-hash and live-token exposure finding and further “abnormal activity,” it took KYT (UI and API), address screening products and the login page offline. An earlier 4 November customer email described an “on-path attack” that exposed a subset of passwords and said that vector had been contained; the later same-day update broadened the exposure language to all users’ hashes and live tokens.
A 6 November update described phased restoration with trusted-IP allowlisting, and required all users to reset passwords and rotate API keys before registering transactions. The 7 November note restored Reactor, KYT and Address Screening. As of Research’s 9 November check, the status page still showed Investigations API and Rapid Lookup under maintenance, with an 8 November password-reset-errors incident marked resolved.
What customers are told to do
Defence steps in the company’s own language are concrete: submit trusted IP addresses for allowlisting, reset passwords, rotate API keys, and enable two-factor authentication where it is not already on. Chainalysis also warned customers not to trust password-reset links in email and to go directly to the login page. Those steps apply even after the 7 November restore: enhanced security measures on reconnect are part of the recovery, not an optional add-on. Operators who reuse Chainalysis passwords elsewhere should treat those accounts as in-scope for a reset as well, which the company recommended during the 4 November lockouts. Related TSN context includes the Binance hack security incident that Chainalysis explicitly separated from this event, and Wiz’s Black October tally of AI-developer platform breaches—a different victim set, useful mainly as industry backdrop for agentic-attack language.
Compliance tooling is high-value identity infrastructure
A blockchain-analytics vendor that holds password hashes and live tokens for “all” users is not a peripheral SaaS account store. Those credentials sit in front of transaction-monitoring and investigation workflows that compliance teams treat as authoritative. Exposing them forces every customer into a coordinated reset, which is why the restore path runs through allowlists and key rotation rather than a simple “service is back” banner.
The company’s insistence that investigation content and attribution data show no evidence of access is the right claim to track, and also the claim that remains hardest for outsiders to verify. The durable public facts are the all-users exposure wording, the product outage window, the 7 November restore of Reactor/KYT/Address Screening, and the mandatory credential hygiene. What is still open is how many KYT accounts were accessed without authorisation and whether Investigations API and Rapid Lookup return to a clean status without a second cutover.
Until Chainalysis publishes those counts, treat the incident as an identity-plane breach of a compliance vendor, not as a confirmed theft of case graphs. The absence of a public victim tally is itself part of the evidence picture: operators must act on the all-users exposure wording without waiting for a census.
Sources
Related stories
Wiz’s Black October count of AI developer platform breaches is the nearest industry backdrop for the “offensive agentic techniques” language Chainalysis used in its first notice.
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
