Chainalysis now says names, usernames, password hashes and live tokens for all its users were exposed, reversing its October 30 finding of no credential access. KYT and Address Screening are coming back in phases from November 6; Reactor and Data Solutions stay offline. Every user must reset passwords and rotate API keys.
If your company uses Chainalysis, plan for a password reset and an API key rotation before you can work in it again. Chainalysis said in a November 4 update to its incident page that “names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor.” It will require every user to reset passwords and rotate API keys “as appropriate.”
What Chainalysis changed its account of
The blockchain analytics company first disclosed the intrusion on October 30. Back then it said an outside actor had used “offensive agentic techniques” to get into its systems and internal tools, and that it had found no evidence of access to authentication credentials or session tokens. Names, email addresses, user IDs and role labels were accessed, it said.
The November 4 updates replaced that picture:
- A subset of passwords. At 9:50 AM EST, Chainalysis told affected customers that an “on-path attack” had exposed a subset of customer passwords, locked their accounts and required a reset.
- All users’ hashes and tokens. At 11:00 PM EST, it said password hashes and live tokens for every user had been exposed. It has not said plaintext passwords or MFA secrets were taken.
- Products offline. Reactor and Data Solutions went offline on November 2. KYT, its user interface and API, other address screening products and the login page followed on November 4, along with Chain (Beta).
As of a November 6 update at 3:30 AM EST, Chainalysis says it has begun restoring KYT and Address Screening in phases, with more customers regaining access over several hours. Reactor and Data Solutions remain offline. The company has not published how many users or organizations are affected, and nobody has named the attacker. The Hacker News reports it is unclear who is behind the attack.
Compliance teams lose screening until keys are rotated
KYT is the transaction-monitoring tool exchanges and fintechs use to screen crypto transfers. Chainalysis’s restoration steps put the reset before the work: once access returns, users must reset passwords and rotate API keys “before registering transactions.” If your screening runs through the KYT API, expect a gap until your keys are swapped.
What to do now:
- Send Chainalysis your trusted IP addresses. Its November 6 update asks customers to submit them for an allowlist, through support or their account team.
- Line up the key rotation. Find every service, script and vendor integration that holds a Chainalysis API key, so you can swap them in one pass when access returns.
- Reset reused passwords elsewhere. Chainalysis recommends resetting any other account that shares a Chainalysis password. A leaked hash can be cracked offline if the password was weak.
- Turn on two-factor authentication for your organization if you haven’t. Chainalysis recommended it in its October 30 email.
- Watch for phishing. Names, usernames and roles in an attacker’s hands make convincing fake reset emails. Only follow reset steps from the Chainalysis incident page or your account team.
The bigger lesson is in the timeline. Chainalysis’s first finding of “no evidence” of credential access lasted five days. When a vendor discloses a breach, start the key inventory on day one instead of waiting for the final scope. We covered the same pattern with Northflank’s breach and AI API keys and with stolen cloud keys driving $1 million AI bills.