9 NOV 2026 — Chainalysis, the blockchain-analysis company whose compliance software monitors crypto transactions, said on Saturday, 7 November, that Reactor, KYT and Address Screening were "now back online". The 1:50 p.m. US Eastern time update on the company's incident page closed a week in which the company's account of the breach changed sharply. On 30 October it said it had found no evidence that credentials had been accessed. By 4 November it said password hashes and live tokens for every user had been exposed.
Customers are being asked to reconnect "in a specific way", with instructions sent by email. The Saturday update does not say whether Data Solutions, the threat-intelligence product taken offline alongside Reactor, has returned.
The company's updates, in order
Every entry below comes from the same incident page, which keeps each update in place under its own date stamp. We compared the 30 October text with an archived copy captured that evening and with a second snapshot from 6 November. Apart from spacing, the earlier updates have not been edited.
-
Credentials said to be safe
The first notice says the company found "no evidence of unauthorized access to investigation content, authentication credentials, or session tokens". Its email to customers says an external actor used "offensive agentic techniques" and that names, email addresses, user IDs and role labels of platform users were accessed.
-
Reactor taken offline
Reactor and Data Solutions are taken offline. The compliance products stay up, a decision the company ties to "their role in detecting money laundering". The update gives no time and does not mention exposed credentials.
-
Some passwords exposed
An email to certain customers says an "on-path attack" exposed "a subset of customer passwords". Their accounts are locked and they must reset.
-
KYT goes dark
Citing "abnormal activity", the company takes KYT, both its interface and its API, offline with the address screening products and the login page.
-
All users affected
Chainalysis says that on Monday it found "names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor". It is notifying customers whose KYT accounts "appear to have been accessed without authorization".
-
Phased return begins
KYT and Address Screening come back in phases. Customers must send trusted IP addresses for an allowlist, and every user has to reset passwords and rotate API keys.
-
Three products restored
Reactor, KYT and Address Screening are reported back online "with enhanced security measures".
How long each product was down
Each time below is when an update was posted, in US Eastern Standard Time, and may come after the event it describes.
KYT and Address Screening were offline by 10:30 a.m. on Wednesday. The phased return began by 3:30 a.m. on Friday, 41 hours later. Full service was reported at 1:50 p.m. on Saturday, which by our count is 75 hours and 20 minutes, a little over three days, after the shutdown notice.
Reactor was down for longer. The Monday update says it had already been taken offline but gives no time. Even counting from the last minute of 2 November, Reactor was unavailable for at least four days, 13 hours and 50 minutes before Saturday's update.
The Monday discovery came three days after the 30 October notice, but the update the company posted that Monday did not mention it. Going by the posting times, Chainalysis first said so publicly at 11:00 p.m. on Wednesday, two days later. It also said on 4 November that it still had "no evidence that any investigations data has been accessed or Chainalysis attribution data has been manipulated". It has not named the attacker, and it has not said which hashing method protected the exposed passwords, a point The Register noted on 5 November.
Chainalysis also told users who had reused their password elsewhere to change it there. Our password generator makes a fresh one.
View author profile → · Editorial policy
