Chainalysis Says Breach Exposed Password Hashes and Live Tokens for All Users; Reactor, KYT Back Online

Chainalysis, a blockchain analytics firm, said on November 4 that a malicious actor had exposed names, usernames, password hashes and live tokens for all of its users. The company first disclosed the incident on October 30, when it said it had found no evidence that authentication credentials or session tokens had been accessed.

On November 7, Chainalysis said its Reactor investigation software, Know Your Transaction (KYT) platform and address screening products were back online with enhanced security measures. As of November 10, its incident page has no updates after that date and does not confirm that Data Solutions, Chain (Beta) or the login page have been restored.

Timeline From the First Notice to Restoration

The incident page dates the first notice to October 30. It described access to some non-sensitive identity details, including user IDs, full names, email addresses and organization role labels. The notice said there was no evidence of unauthorized access to investigation content, authentication credentials or session tokens.

On November 2, Chainalysis took Reactor and Data Solutions offline as a precaution. On November 4, it reported an on-path attack that exposed a subset of customer passwords. It locked affected accounts.

Later on November 4, the company found abnormal activity, took the KYT user interface and API, other address screening products and the login page offline, and notified customers whose KYT accounts appeared to have been accessed without authorization. Phased restoration of KYT and Address Screening began on November 6, with more customers expected to regain access over the following hours. The company said Reactor, KYT and Address Screening were back online on November 7.

Scope Stated in the Update
Chainalysis’s November 4 update says names, usernames, password hashes and live tokens were exposed for all users. The company also says it has no evidence that investigations data was accessed.

What Was Exposed and What the Company Has Ruled Out

The November 4 update says names, usernames, password hashes and live tokens were exposed for all Chainalysis users. The Record reports that the update does not specify whether every category applied to every user.

Chainalysis says it has no evidence that investigations data was accessed or that attribution data was manipulated. According to The Hacker News, it is unclear who is behind the attack. Chainalysis said the incident was similar to many other tech platforms in recent weeks.

Chainalysis has not said how many users it has or how many were affected. The October 30 notice said it had found no evidence that session tokens had been accessed, and the November 4 update says live tokens were exposed. The Record reports that Chainalysis did not explain what it meant by ‘live tokens.’

What Customers Are Being Told to Do

Chainalysis has told customers to reset passwords through the usual login page, not through links in password-reset emails. Users who reused that password elsewhere should change it there too. The October 30 guidance also advised enabling two-factor authentication if it was not already in place.

Every user will have to reset passwords and rotate API keys as appropriate. Customers who want KYT access restored were asked to send trusted IP addresses to support or their account team for an allowlist. They must reset passwords and rotate API keys before registering transactions.

The Record reports that, while KYT was offline, Chainalysis had not explained how customers were screening transactions.

Chainalysis has not said how many users it has or what it meant by ‘live tokens.’

Open Questions as of November 10

The incident page does not confirm that Data Solutions, Chain (Beta) or the login page have been restored. No update dated November 8, 9 or 10 appears on the page.

Chainalysis has not named the attacker. The Hacker News reports that it is unclear who is behind the attack. The Record reports that the company described an external actor using offensive agentic techniques, a term the company has not explained.

The restoration status of the remaining services and any published user count remain open.