Chainalysis Restores Data Solutions After All-User Data Exposure

Chainalysis brought its Data Solutions product group back online at 3 a.m. ET (08:00 UTC) on Nov. 10, completing the recovery of its core compliance tooling after a cyberattack that exposed names, usernames, password hashes and live tokens tied to all users of the platform.

The blockchain analytics firm emailed customers step-by-step reconnection instructions. Organizations must submit trusted IP addresses for allowlisting, and users must reset passwords and rotate API keys where applicable before registering transactions. The conditions apply across the restored product set, not just to Data Solutions.

What came back first?

The Nov. 10 restoration followed an earlier, partial recovery. Chainalysis restored Reactor, its Know Your Transaction (KYT) interface and API, and Address Screening at 1:50 p.m. ET (18:50 UTC) on Nov. 7, with what the company described as enhanced security measures in place. TokenPost reported on the return of those three services at the time.

That staging matters operationally. Reactor and KYT sit at the center of compliance workflows at exchanges, banks and law enforcement agencies, and a prolonged outage would have forced those customers to rerun transaction monitoring through manual or secondary tools. Data Solutions, restored three days later, completes the set.

How did the attackers get in?

Chainalysis characterized the incident as a multifront cyberattack. According to the company, an outside actor used "offensive agentic techniques" — automated, AI-driven methods — to access its systems and internal tools.

Separately, the company disclosed that an "on-path attack" exposed passwords for a subset of customers, and that some KYT accounts appeared to have been accessed without authorization. Chainalysis said it has contained and remediated the on-path attack. The company did not specify how many accounts fell within that subset or attribute the activity to a named actor.

The breach scope is unusually broad on paper. The exposed dataset covered names, usernames, password hashes and live tokens for all users — not a limited sample. Live tokens in particular are operationally sensitive, since they can grant API access to customer environments until rotated, which is why the mandatory key rotation is a precondition for resuming transaction registration.

Was investigation data compromised?

In its Nov. 4 update, Chainalysis said it had found no evidence at that time that investigation data had been accessed or that attribution data had been manipulated. That distinction carries weight for the firm's government and law-enforcement clients, whose casework depends on the integrity of Chainalysis attribution clusters and ledgers.

The company's caveat — "at that time" — signals the review is ongoing rather than closed. Chainalysis has not announced a final incident report or a completion date for the forensic review.

What happens next?

For now, the burden of remediation sits with customers. Until each organization completes IP allowlisting, password resets and API key rotation, transaction registration on the restored platform remains blocked — meaning compliance teams still face days of onboarding-style work before their workflows return to pre-incident throughput.