Chainalysis tells all users to reset passwords and rotate API keys

Chainalysis tells all users to reset passwords and rotate API keys

6 November 2026: Chainalysis now says names, usernames, password hashes and live tokens for all users were exposed to a malicious actor, and it requires every user to reset a password and rotate API keys before registering transactions again. Its compliance monitoring product, KYT, is coming back in phases, while Reactor and Data Solutions remain offline. The company sells blockchain analytics and transaction screening to compliance teams.

Not yet independently verified. The account rests on Chainalysis's own incident notice, updated 6 November. It gives no customer count, root cause or attacker, and the restoration timetable may have moved since. We will update this when it can be confirmed, and remove this note.

How the account changed over a week

The notice has been rewritten several times, and the changes matter more than any single version.

• 30 October: the company said it was the target of an incident. A customer email described an outside actor using "offensive agentic techniques". User IDs, names, email addresses and organisation role labels were accessed, with no evidence at that point of access to investigation content, credentials or session tokens
• 2 November: Reactor and Data Solutions were taken offline as a precaution, while KYT stayed up
• 4 November, 09:50 Eastern: an "on-path attack" exposed a subset of customer passwords, and those accounts were locked
• 4 November, 10:30 Eastern: KYT, other address screening and the login page went offline after abnormal activity
• 4 November, 23:00 Eastern: names, usernames, password hashes and live tokens for all users were reported exposed
• 6 November, 03:30 Eastern: KYT and Address Screening began returning in phases

So a customer who read the first statement and closed the matter was working from a position the company has since withdrawn. Chainalysis says it has no evidence that investigation data was accessed or attribution data changed.

The steps before KYT works again

The conditions for coming back are concrete. Customers are asked to submit trusted IP addresses for an allowlist. All users must reset passwords and rotate API keys before registering transactions, and two-factor authentication is recommended.

A compliance team should treat the API key rotation as more than a chore. Any integration that sends transactions to KYT will stop registering until the new key is in place, so there may be a gap in monitoring records that needs explaining to a regulator or an auditor. Writing down when screening stopped and resumed, and what was done about transactions in that window, is worth doing while the facts are fresh.

What a screening outage means for customers

Live tokens are the detail with the longest reach. A password reset does not always invalidate an existing token, so customers should confirm with the company that old tokens have been revoked rather than assume so. Anyone who reused a Chainalysis password elsewhere has a separate job to do.

Teams that depended on Reactor for investigations have no return date from the notice. Chainalysis says only that the products stay offline while they are hardened, and it has not said how many customers were affected.

Related on TrustList:

• Entra ID retires Microsoft's SMS and voice codes for password reset

Sources

• Chainalysis: Updated Nov 6, Security Incident Information, first published 30 October 2026, 6 November 2026