Key Takeaways
- Chainalysis began restoring KYT and Address Screening on Nov. 6 after a cyberattack forced multiple services offline.
- The company disclosed exposure of customer information, including password hashes and live tokens, affecting all users.
- Customers must reset passwords and rotate API keys where applicable as access returns.
Chainalysis has begun restoring access to its transaction monitoring and address screening services after a cyberattack exposed customer information, including password hashes and live tokens, and forced multiple products offline.
In a Nov. 6 update, the blockchain analytics company said it was gradually reopening KYT and Address Screening, with additional customers expected to regain access over the following hours.
The recovery follows increasingly serious disclosures that expanded the incident beyond the customer profile information Chainalysis initially reported compromised. Its investigation remains ongoing.
Service Restoration Comes With Mandatory Security Checks
Chainalysis said it would validate enhanced security controls and monitor each restoration phase before extending access to remaining customers.
Customers must submit trusted IP addresses to the company’s support team or account representatives for inclusion on an allowlist. Once access returns, users must reset their passwords and rotate API keys, where applicable, before registering transactions.
The company said external security specialists were also helping strengthen its systems and restore Reactor and Data Solutions. Its latest notice provided no firm timetable for those products.
Chainalysis had initially planned to begin restoring KYT and Address Screening on Nov. 5. Friday’s announcement confirmed that the phased recovery had started, without declaring a complete return to service.
The disruption reached beyond product availability. On Nov. 4, Chainalysis told customers who had just received password-reset instructions that they could not immediately complete the process because its login page was offline.
Credential Exposure Expands Earlier Findings
Chainalysis first publicly disclosed the incident on Oct. 30, saying an external actor had gained unauthorized access to systems and internal tools.
At that stage, the company reported access to user IDs, names, email addresses, and organizational role labels. It said investigators had found no evidence of compromised authentication credentials or session tokens.
That assessment changed.
In its late Nov. 4 update, Chainalysis said it had discovered on Monday, Nov. 2, that customer information, including names, usernames, password hashes and live tokens for all users, had been exposed to a malicious actor.
The statement did not specify whether every listed category of information had been exposed for every individual user.
Separately, the company notified certain customers that an “on-path attack” had exposed a subset of passwords. Chainalysis said it had contained and remediated that attack vector and locked affected accounts as a precaution.
That narrower containment statement did not establish that the broader incident had ended.
Chainalysis also said it was directly notifying customers whose KYT accounts appeared to have been subject to unauthorized access. This disclosure followed abnormal activity that prompted it to shut down KYT’s interface and API, other screening products, and the login page.
Investigation Data Assurance Remains Qualified
Despite the credential exposure and apparent KYT account intrusions, Chainalysis said it still had no evidence that attackers accessed its investigation data or manipulated its attribution data.
That distinction leaves the confirmed exposure separate from any demonstrated compromise of investigative content. The company’s assurance reflects its findings so far, rather than a completed investigation.
Chainalysis described the initial intrusion as involving “offensive agentic techniques,” but its notice did not identify the attacker or explain the precise tools involved. It also said the incident was unrelated to the recent Binance crypto theft.
For customers, the immediate priorities remain the recovery of controlled accounts and credential replacement.
Chainalysis urged users to visit its usual login page directly, remain alert to suspicious communications, and change passwords on other services wherever they had reused exposed credentials.
The phased reopening represents progress toward recovery, while critical services and the full scope of the incident remain under review.
Top Trending Crypto Articles
The information provided in this article is for informational purposes only. It is not intended to be, nor should it be construed as, financial advice. We do not make any warranties regarding the completeness, reliability, or accuracy of this information. All investments involve risk, and past performance does not guarantee future results. We recommend consulting a financial advisor before making any investment decisions.
Giuseppe Ciccomascolo began his career as an investigative journalist in Italy, where he contributed to both local and national newspapers, focusing on various financial sectors.
Upon relocating to London, he worked as an analyst for Fitch's CapitalStructure and later as a Senior Reporter for Alliance News. In 2017, Giuseppe transitioned to covering cryptocurrency-related news, producing documentaries and articles on Bitcoin and other emerging digital currencies. He also played a pivotal role in establishing the academy for a cryptocurrency exchange website. Crypto remained his primary area of interest throughout his tenure as a writer for ThirdFloor.
