Chainalysis Restores Core Tools After Breach Exposed All User Logins

Chainalysis, the blockchain-analytics firm that banks and law-enforcement agencies rely on to trace crypto crime, restored its core screening tools on Nov. 7 after a breach exposed login credentials and live session tokens for every user of its platform. The recovery is partial: the Investigations API and Rapid Lookup remain under maintenance, and customers must complete a series of security steps before they can resume screening transactions.

The service dashboard listed KYT's interface and API, along with Address Screening, as operational on Nov. 7, with Reactor returning shortly after. That green status does not mean every customer is back online. Access is being restored in phases, and Chainalysis is validating enhanced security controls during the process.

What happened in the breach?

The incident grew far worse than first disclosed. On Oct. 30, Chainalysis posted an initial notice saying an unauthorized party had accessed user IDs, names, email addresses and organization role labels. CryptoSlate covered that disclosure on Oct. 31.

Then came the Nov. 4 update, published at 11 p.m. EST. In it, Chainalysis said it had discovered on Nov. 2 that the exposure went much deeper: names, usernames, password hashes and live login tokens for all users had been available to a malicious actor. Password hashes are encoded password records, and live tokens are what keep a user signed in — either one in the wrong hands is a serious problem for a company whose customers include financial institutions and government investigators.

One caveat matters here. The disclosure that every user's credentials were exposed does not establish that every account was actually accessed. Chainalysis has not claimed that, and it has been notifying specific customers whose KYT accounts appeared to have been accessed without authorization.

Why did the tools go offline?

The same Nov. 4 update explained the outage. Abnormal activity that day prompted Chainalysis to take KYT, its other address-screening products and the login page offline. It was a defensive shutdown, not a routine maintenance window — the company cut off its own flagship products while it investigated.

At that point, the company made two careful claims. It said it had no evidence that investigation data had been accessed. It also said it had no evidence that attribution data — the analytical output that links wallets to real-world actors — had been manipulated. Its investigation remained ongoing.

For Chainalysis customers, the stakes are obvious. KYT monitors transactions in real time for compliance teams. Address Screening assesses wallet risk exposure. Reactor helps investigators trace funds across blockchains. When those tools vanish, transaction monitoring stops, alerts go unreviewed and casework stalls.

What does this change for customers?

The practical question every screening customer now faces: what do I have to do before I can work again? Chainalysis answered that in its Nov. 6 restoration instructions.

The steps are:

• Submit trusted IP addresses for the company's allowlist, through an account team or support contact, if not already done.
• Reset passwords after access is granted.
• Rotate all applicable API keys.
• Only then register transactions.

The IP allowlist requirement is the notable operational shift. It means Chainalysis is moving from open, credential-based access toward network-restricted access. For large institutions, that is administrative work — security teams will need to enumerate every egress IP that touches the API. For smaller customers, it could delay restoration further.

What's still unclear?

The Investigations API and Rapid Lookup outages continue, with no stated return date. The status of customer investigation data remains the open question. Chainalysis says it has no evidence of access, but its investigation is ongoing, and the company has already revised its disclosure once — expanding it from partial identity data on Oct. 30 to full credential exposure on Nov. 4.

There is also a reputational dimension the company cannot screen away. Chainalysis sells certainty — attribution, risk scoring, traceable chains of custody for evidence. A breach of its own login infrastructure, exposing the session tokens of the very investigators who use Reactor, hands ammunition to defense attorneys and rivals alike. Any evidence produced with the platform during the exposure window may now face sharper scrutiny in court.

For now, the phased restoration continues. Customers watching the dashboard should expect the Investigations API and Rapid Lookup statuses to change in the coming days as validation of the new security controls proceeds.