Chainalysis Reopens KYT After Credential Breach, Mandates Resets

Chainalysis disclosed on Nov. 4 that it had discovered on Nov. 2 that names, usernames, password hashes and "live tokens" for all of its users had been exposed to a malicious actor.

As of Monday afternoon, the company's status page listed KYT's interface and API, Address Screening and Reactor as operational again — with every customer now required to reset passwords and rotate API keys before the platform registers transactions.

What did the breach expose, and when?

The sequence of Chainalysis's response matters for anyone still waiting on the platform:

• Nov. 2 — the company discovers that names, usernames, password hashes and "live tokens" for all users have been exposed to a malicious actor
• Before Nov. 4 — Reactor and Data Solutions go offline while the transaction-monitoring products stay running
• Nov. 4 — Chainalysis takes down KYT's interface and API, the other address-screening products and its own login page after detecting abnormal activity
• Nov. 4 — the company discloses the incident and says it is directly notifying customers whose KYT accounts appear to have been accessed without authorization
• Monday — KYT, Address Screening and Reactor come back, with mandatory credential resets attached

What did the disclosure leave unanswered?

Chainalysis did not specify how many KYT accounts appeared to have been accessed, or what the exposed "live tokens" covered. In the Nov. 4 update, the company said it continued to have no evidence that investigation data had been accessed or that its attribution data had been manipulated.

What does the credential reset require?

Chainalysis's reconnection instructions say old passwords have expired and prior API keys no longer work. All users must reset passwords and rotate API keys, as applicable, before registering transactions. KYT and Address Screening integration managers must generate replacement keys and use them in their integrations.

Access also turns on network allowlisting: customers that have not submitted trusted IP addresses must send them to support or their account team. KYT monitors cryptocurrency transactions for risk, while Address Screening assesses wallet risk exposure.

Which products are actually back?

Recovery is not complete across the platform. As of Monday afternoon, the status page showed:

• KYT interface and API — operational
• Address Screening — operational
• Reactor — operational
• Investigations API — under maintenance
• Rapid Lookup — under maintenance
• Customer Admin Portal — unavailable, per the latest Sunday update
• Training Academy — unavailable, per the latest Sunday update

How did a bridge get caught in the outage?

The disruption reached at least one downstream bridge. Metallicus CEO Marshall Hayner responded Sunday to a user reporting trouble transferring from Metal Pay to WebAuth, writing: "We are awaiting Chainalysis to turn back online and the bridge should be resumed shortly."

Chainalysis's Monday confirmation came in reply to Hayner and did not confirm the bridge had resumed. Metal Pay's status page still listed cryptocurrency deposits and withdrawals as under maintenance on Monday.

What breaks for compliance teams?

For institutions that automated compliance around Chainalysis, the bill is credential continuity rather than confirmed data loss. Prior API keys no longer authenticate, and transaction registration stalls until an integration manager swaps in replacement keys and files trusted IPs with support.

The remaining gaps are administrative as much as technical. Casework that depends on the Investigations API or Rapid Lookup has no published restart date, and with the Customer Admin Portal and Training Academy still offline, the rest of the recovery runs through support and account teams.

Until Chainalysis publishes restoration times for the Investigations API, Rapid Lookup and the Customer Admin Portal — and Metal Pay confirms the bridge is moving funds again — investigations and cross-rail transfers stay queued.