Crypto’s crime-tracking giant restores its main tools after hackers exposed every user’s login data

Blockchain analytics company Chainalysis has restored Reactor, KYT and Address Screening services after a security incident exposed account information for all its users. The company announced the return of these services on Nov. 7 with enhanced security measures, while Investigations API and Rapid Lookup services remained under maintenance as of Nov. 9.

Restoration Process

Chainalysis disclosed that all users' account information was compromised, including user IDs, names, email addresses, organization role labels, password hashes and live login tokens. The company began restoring services on Nov. 7 after taking them offline on Nov. 4 when abnormal activity was detected.

The restoration process is phased, with access to KYT and Address Screening being gradually reinstated. Customers must reset passwords and rotate API keys before they can register transactions, even if the service dashboard shows as operational.

We were validating enhanced security controls during the phased restoration.

Security Requirements

Before resuming services, Chainalysis required customers who hadn't already done so to submit trusted IP addresses for its allowlist through their account team or support contact. The company emphasized that operational labels on the dashboard do not mean every customer is ready to register transactions.

The security breach follows an initial disclosure on Oct. 31 that user IDs, names, email addresses and organization role labels had been accessed. A Nov. 4 update revealed that password hashes and live login tokens for all users had also been exposed, though the company found no evidence that investigation data was accessed or attribution data manipulated.

Service Functions

KYT monitors transactions, Address Screening assesses wallet risk exposure, and Reactor helps investigators trace funds across blockchains. While Reactor has been restored, the status of Investigations API and Rapid Lookup services remains unclear as the company continues its investigation.