Updated November 6, 2026: This report incorporates the company’s 03:30 EST / 08:30 UTC update and replaces its initial credential-exposure assessment.
Chainalysis says it has begun phased restoration of KYT and Address Screening. Its latest incident notice requires trusted-IP allowlisting, password resets and applicable API-key rotation before customers resume registering transactions. Reactor and Data Solutions remain offline.
The recovery follows a November 4 disclosure that names, usernames, password hashes and live tokens for all users were exposed to an attacker. Chainalysis is notifying customers whose KYT accounts appear to have been accessed without authorization.
The company still reports no evidence of accessed investigation data or manipulated attribution data. These remain provisional findings. The incident was first disclosed October 30; Reactor and Data Solutions were taken offline by the November 2 update.
Verify recovery requests independently
Credential exposure can make follow-up messages more convincing. Verify recovery instructions through a known account contact or a bookmarked service address. A message that correctly names an employee or organization does not establish the sender’s identity.
Keep an internal record of password resets, replacement API keys and restored integrations so that access recovery can be checked against the organization’s own systems.
