Chainalysis has expanded its security-incident disclosure from limited customer metadata exposure to names, usernames, password hashes and live tokens for all users. Its November 4 update also described abnormal activity affecting its Know Your Transaction (KYT) service and said it was notifying customers whose KYT accounts appeared to have been accessed without authorization.

The latest update in the reviewed statement, dated November 6 at 3:30 a.m. EST, says phased restoration of KYT and Address Screening has begun. Customers must provide trusted IP addresses for allowlisting and, once access is granted, reset passwords and rotate API keys as applicable before registering transactions. That is a recovery process—not confirmation that every customer or product is back online.

What changed in the disclosure

The original October 30 notice said Chainalysis had found no evidence of unauthorized access to authentication credentials or session tokens. Its November 4, 11 p.m. EST update materially changed that assessment: the company said it had discovered on Monday that password hashes and live tokens for all users were exposed. Teams should use the later disclosure when deciding their response, rather than relying on the initial reassurance.

Chainalysis separately described an on-path attack exposing a subset of customer passwords. That statement should not be collapsed into a claim that every user's plaintext password was stolen. The broader confirmed exposure described in the later update concerns password hashes and live tokens.

The company removed access to Reactor and Data Solutions during its investigation. After detecting abnormal activity, it also took KYT's interface and API, address-screening products and the login page offline. The November 6 update describes phased recovery of KYT and Address Screening while work to restore Reactor and Data Solutions continues.

Who needs to act

Organizations using Chainalysis for investigations, transaction monitoring or address screening should coordinate security and operational recovery. For a government contractor or smaller compliance team, the immediate question is whether staff accounts, automated integrations or required screening workflows depend on the affected services. A vendor outage and exposed access credentials create different tasks; restoring one does not close the other.

Chainalysis says it still has no evidence that investigations data was accessed or its attribution data manipulated. That is an important limitation, not proof that no account activity occurred: the same disclosure describes apparent unauthorized KYT access. The reviewed statement does not provide a complete technical root cause, identify an actor's country, or establish that every customer's account was used by an attacker. It also explicitly says this incident is unrelated to the Binance theft.

Practical recovery priorities

  • Use a known support route. Coordinate trusted-IP allowlisting through an established Chainalysis account contact or independently verified support channel. Go directly to the usual login destination rather than following unexpected reset messages. Treat urgent recovery communications as potential impersonation lures.
  • Track passwords, tokens and API keys separately. Complete the required password reset and applicable API-key rotation when access is restored. Ask the vendor which sessions and tokens were invalidated and what additional customer action is required. Do not assume a password change proves every previously issued access token is unusable.
  • Recover integrations deliberately. Inventory applications, scheduled jobs and approved secret stores using Chainalysis credentials. Replace affected keys, remove old copies and validate the expected integration identity and permissions before restarting automation. Record who owns each remaining recovery task.
  • Review available account evidence. Preserve customer-side integration logs and relevant notifications. Request account-specific access information from Chainalysis; examine unexpected user changes, API activity or transactions where records are available. Missing logs should be documented as a visibility limit, not interpreted as a clean result.
  • Reconcile monitoring gaps. Record when screening or transaction registration stopped, what queued or failed, and which records still need processing. Use approved continuity procedures and verify results after recovery. A successful login or one successful API call does not demonstrate that a backlog was screened.
  • Contain password reuse elsewhere. If a Chainalysis password was reused, replace it on those other services with unique credentials. Enable two-factor authentication where available, while recognizing that already-exposed tokens require a separate response.

Bulwark assessment

The actionable issue is not the label attached to the attacker's tooling. It is the combination of exposed authentication material, indications of unauthorized account access and disruption to a service used for security and compliance decisions. Treat vendor restoration, customer access recovery and operational reconciliation as separate workstreams with separate evidence of completion.

Close the incident only when the organization's affected credentials and integrations have been accounted for, account-specific findings reviewed, and interrupted workflows reconciled. Keep the scope open where the vendor's investigation has not yet answered a relevant question. These are defensive recommendations based on the disclosed exposure, not claims that additional compromise has been observed.

Primary source: Chainalysis security-incident statement, originally October 30 and updated through November 6, 2026.

Secondary context: BleepingComputer's November 6 reporting on the expanded disclosure. The primary statement governs the scope and dated restoration status above.