Developing: Chainalysis says password hashes and live tokens for all users were exposed. A KYT restore has begun

In brief

Developing. Last updated 6 November 2026, afternoon Asia/Dubai (UTC+4). The company's account may change as the restore continues.

On Friday 6 November 2026 at 3:30 a.m. EST (12:30 Asia/Dubai), Chainalysis said it had begun restoring access to KYT and Address Screening through a phased approach, with more customers expected over the next several hours. That update follows a sharper disclosure than its 30 October claim: on 4 November the company said password hashes and live tokens for all Chainalysis users had been exposed to a malicious actor.

What changed in the company's account

On 30 October, Chainalysis said it had been the target of a cybersecurity incident. Based on the investigation to date, it reported no evidence of unauthorised access to investigation content, authentication credentials or session tokens. It said an external actor using "offensive agentic techniques" had gained unauthorised access to its systems and internal tools, and that some non-sensitive customer data had been accessed: user IDs, full names, email addresses and organisation role labels. It said it had found no indication of access to investigation content, passwords in clear text, MFA secrets or user session tokens. It also said the incident was not related to the recent crypto theft at Binance.

Two separately dated disclosures on 4 November must be kept apart. At 9:50 a.m. EST (18:50 Asia/Dubai), Chainalysis said an "on-path attack" had exposed a subset of customer passwords — not all users — and that the attack vector had been contained and remediated. It emailed those customers to require a password reset, locked the accounts as a precaution, and said it had no evidence those accounts had been improperly accessed.

At 11:00 p.m. EST that day (08:00 Asia/Dubai on 5 November), the company said that on Monday (2 November) it had discovered names, usernames, password hashes and live tokens for all Chainalysis users had been exposed. It still reported no evidence that investigations data had been accessed or attribution data manipulated, and said it was notifying customers whose KYT accounts appear to have been accessed without authorisation.

What is down or restoring

On 2 November, Chainalysis took Reactor and Data Solutions offline while keeping compliance transaction-monitoring products running under close monitoring. On 4 November at 10:30 a.m. EST (19:30 Asia/Dubai), after abnormal activity, it took KYT (UI and API) offline alongside other address-screening products and the login page; Reactor, Data Solutions and Chain (Beta) remained offline.

As of the 6 November 3:30 a.m. EST update, KYT and Address Screening are returning in phases. Reactor and Data Solutions are not yet restored; the company says it is still hardening systems with external security experts.

What customers should do now

Chainalysis asks customers who have not already done so to submit trusted IP addresses for its allowlist to support@chainalysis.com or their account team. Once access is granted, all users must reset passwords and rotate API keys, as applicable, before registering transactions. Those are the company's stated restore steps.

Sources and scope

Primary facts, product names, dated headings and customer instructions are from Chainalysis's Updated Nov 6: Chainalysis Security Incident Information post (updates dated 30 October through 6 November 2026 3:30 a.m. EST), re-fetched on 6 November 2026. No newer company update than that 3:30 a.m. EST note was on the page when checked. Secondary corroboration of the 4 November all-users hashes/tokens disclosure and product outages is from The Record (Recorded Future News) (5 November 2026); The Record piece predates the 6 November restore update. Interpretive framing and keeping the on-path and all-users disclosures separate are ByteNib editorial analysis.

Drafted with AI assistance and reviewed by the editor before publication.

Cover illustration: AI-generated illustration: ByteNib

Continue exploring: Cybersecurity analysis, the related implementation tutorial, and the structured learning path.