Key takeaways
- On November 4, Chainalysis said names, usernames, password hashes and live tokens for all its users were exposed to a malicious actor.
- That contradicts its October 30 statement that it had found no evidence of access to credentials or session tokens.
- KYT and Address Screening are returning in phases from November 6, with password resets and API key rotation required; Reactor and Data Solutions remain offline.
The Chainalysis breach is larger than the company first said. The blockchain analytics firm says a security incident it first disclosed on October 30 exposed password hashes and live tokens for all of its users, and that it had to take its KYT transaction monitoring product offline on November 4. The company began restoring KYT and Address Screening in phases on November 6. Reactor and Data Solutions are still down.
The incident matters beyond Chainalysis. Exchanges, banks and compliance teams use KYT to screen crypto transactions, so an outage there stops customers from registering transactions. Chainalysis also says the attacker used "offensive agentic techniques", meaning AI agents doing the intrusion work.
What Chainalysis has said, in order
The company keeps one running page and has revised its account three times.
- October 30: Chainalysis said an outside actor used offensive agentic techniques to get into its systems and internal tools. It said it had found no evidence that authentication credentials or session tokens were accessed. The data it did confirm: user IDs, full names, email addresses and organization role labels.
- November 2: Chainalysis took Reactor and Data Solutions offline as a precaution. It kept KYT and its screening products running while it investigated.
- November 4, 9:50 a.m. EST: It told some customers that an "on-path attack" had exposed a subset of customer passwords. It locked those accounts and said the attack vector had been contained.
- November 4, 11:00 p.m. EST: It said that on Monday, November 2, it discovered that names, usernames, password hashes and live tokens for all Chainalysis users had been exposed to a malicious actor. The same day it saw abnormal activity, took KYT, its address screening products and the login page offline, and began notifying customers whose KYT accounts appeared to have been accessed without authorization.
The November 4 account contradicts the October 30 statement about credentials and tokens. Chainalysis has not published an explanation of the gap on its page. The company says it still has no evidence that investigation data was accessed or that its attribution data was manipulated.
What restoration looks like
In its November 6 update, posted at 3:30 a.m. EST, Chainalysis said it had started bringing back KYT and Address Screening for some customers, with more to follow over the next several hours. Customers have two things to do:
- Send Chainalysis their trusted IP addresses for an allowlist, through their account team.
- Expect to reset passwords and rotate API keys once access is granted. Every user must do this before registering transactions.
Reactor, the company's investigation tool, and Data Solutions have no restoration date. Chainalysis says it is working with outside security experts to harden its systems first.
What we don't know yet
Chainalysis has not said how many customers or users are affected, when the intrusion began, or how the attacker got in. It has not published the technical details of the "on-path attack". It also has not said whether the October activity and the November activity were the same attacker. The company says the incident is unrelated to the recent crypto theft at Binance.
Customers should watch the Chainalysis incident page for the next update, and reset any password they reused on other services.