Chainalysis disclosed on Nov. 6 that a malicious actor accessed names, usernames, password hashes and live tokens belonging to every user of its compliance‑screening platform. The revelation follows an initial Oct. 30 notice that only non‑sensitive data such as user IDs and email addresses had been compromised. In response, the blockchain analytics firm is phasing the return of its KYT (Know‑Your‑Transaction) and Address Screening tools while keeping Reactor and Data Solutions offline.

Expanded scope of the breach

According to the latest update, the attacker obtained password hashes and “live tokens” for all customers, a step up from the earlier claim that clear‑text passwords and MFA secrets were safe. The company has not disclosed the total number of affected accounts, but it confirmed that the exposure includes names, usernames, password hashes and valid tokens. Chainalysis said there is no evidence that investigation data or attribution data was accessed or altered.

Phased restoration and new security requirements

Chainalysis began restoring access to its KYT and Address Screening products on Friday, Nov. 6, doing so one customer group at a time. Customers must first submit trusted IP addresses for an allowlist before they can log in. Once allowed, every user is required to reset their password and rotate any API keys associated with their account, as reported by Unchained. The firm continues to work with external cybersecurity experts and is employing large‑language‑model tools to review its infrastructure.

Products remaining offline and next steps

The Reactor and Data Solutions suites, taken offline on Nov. 2 as a precaution, stay shut while Chainalysis hardens those services. The company urges users to watch for unexpected password‑reset requests, avoid clicking links in unsolicited emails, and enable two‑factor authentication where possible. It also advises any customers who reused their Chainalysis password elsewhere to change those credentials.

What to watch next

Stakeholders should monitor Chainalysis’s forthcoming updates on the timeline for bringing Reactor and Data Solutions back online, as well as any indications of further data exposure. Additional disclosures about the nature of the “live tokens” and the effectiveness of the IP‑allowlist process will be critical for organizations relying on Chainalysis for AML compliance.