Chainalysis brought Reactor, KYT and Address Screening back online on November 7. This is after a cyberattack that exposed account information and active login tokens for all users. The block
Chainalysis brought Reactor, KYT and Address Screening back online on November 7. This is after a cyberattack that exposed account information and active login tokens for all users. The blockchain analytics firm serves major customers, including the FBI, Coinbase and Barclays. But reopening the tools is only part of the recovery. Customers must also complete additional security checks before they can regain access.
Chainalysis reported on the hack on October 30, claiming that an unauthorized person made use of “offensive agentic techniques” to access the company’s infrastructure and internal measures. The company has not revealed the specific AI tools used and how the hacker gained access.
By November 4, Chainalysis had discovered that names, usernames, password hashes, and live tokens for all users were exposed. Still, that does not mean every account was accessed.
Chainalysis also discovered an “on-path” attack that intercepted some customer passwords. The company stated that it has thwarted that method and confirmed:
“We are directly notifying customers whose KYT accounts appear to have been accessed without authorization.”
Up to this moment, Chainalysis has found no evidence that investigation materials were accessed or its blockchain attribution data have been manipulated. The investigation is still underway.
Chainalysis has confirmed that the Reactor, KYT’s interface and API and Address Screening were operational once again on November 7. However, customers could not start working right away. As part of the phased reopening, they had to submit approved network IP addresses, reset passwords, and replace applicable API keys before registering transactions.
A November 8 status notice still listed the Customer Admin Portal and Training Academy as unavailable. Chainalysis had not confirmed the full restoration of Data Solutions. The firm emailed reconnection instructions, while customers can check its live dashboard for updates.
Chainalysis Breach Timeline: Tool Restoration and $158B in Illicit Crypto Flows
The Chainalysis outage highlights a risk for exchanges, banks and investigators that depend on the same blockchain-screening provider. When the service goes offline, checks on suspicious wallets and transactions may slow across multiple institutions. However, there is no evidence that this incident halted transactions or caused compliance violations.
In October, John Schindler, Secretary General of the Financial Stability Board, warned that if disruptions happen at one provider, multiple institutions can be affected across the borders.
As regulations surrounding cryptocurrencies are becoming stricter, this risk assumes even greater importance. According to the 2027 PwC report, the EU Anti-Money Laundering Regulation introduces its provisions beginning in July 2027, and the UK’s crypto regime goes live starting in October.
Meanwhile, Verizon’s 2026 report found system intrusions in 61% of the breaches studied. However, the research did not examine the Chainalysis attack.
TRM Labs estimated $158 billion in illicit crypto flows in 2025, up nearly 145%. Hackers also stole $2.87 billion across nearly 150 incidents. Yet illicit activity’s share of overall crypto volume fell from 1.3% to 1.2%.
Competition among blockchain-monitoring firms is fierce. Cryptopolitan reported that Chainalysis challenged a $94.66 million US Immigration and Customs Enforcement contract awarded to rival TRM Labs. The breach raises questions about reliability in a business built on trust.
Chainalysis has not disclosed how many KYT accounts may have been accessed or quantified any wider financial loss. For now, the documented impact is exposed credentials, disrupted services and a gradual reopening.
If you're reading this, you’re already ahead. Stay there with our newsletter.
