Chainalysis begins restoring KYT access after data breach exposes user hashes and tokens
Blockchain intelligence firm Chainalysis has begun phased restoration of its KYT and Address Screening tools following a security breach that exposed customer names, usernames, password hashes, and live tokens across all accounts.
Chainalysis announced on Friday, Nov. 6, 2026, that it has started restoring customer access to its KYT and Address Screening services through a phased rollout. The restoration follows a cyberattack first detected on the preceding Monday, when the company discovered that customer information—including names, usernames, password hashes, and live tokens for all Chainalysis users—had been exposed to a malicious actor.[1][2]
During its investigation, Chainalysis took its login page, Address Screening tools, and both the user interface and API for KYT offline after detecting abnormal activity, while also removing access to Reactor and Data Solutions. The company stated that it is directly notifying clients whose KYT accounts appear to have suffered unauthorized access. Crypto commentator Crypto Patel separately claimed that actual passwords were also exposed for a subset of users.[1]
Chainalysis reported having no evidence that any investigation data was accessed or that attribution data was manipulated. As services resume, the firm is requiring users to reset their passwords and rotate API keys before registering transactions. Customers have also been instructed to submit trusted IP addresses to an allowlist while external security experts work to harden company systems and prepare Reactor and Data Solutions for safe reactivation.[1][2]
Key facts
- Chainalysis began a phased restoration of KYT and Address Screening services on Nov. 6, 2026.
- A malicious actor gained access to names, usernames, password hashes, and live authentication tokens for all Chainalysis users.
- Chainalysis pulled KYT, Address Screening, and its login page offline after identifying abnormal activity, having previously shut down Reactor and Data Solutions.
- Chainalysis is directly contacting customers whose KYT accounts appear to have been accessed without authorization.
- All returning users must reset passwords and rotate API keys prior to registering transactions.
- Chainalysis stated there is no evidence that investigation data was accessed or that attribution data was manipulated.
- Industry commentator Crypto Patel reported that actual passwords were exposed for a subset of users.
Sources · 2 sources
- CP
Crypto Patel@CryptoPatelPost on X ·
BREAKING: CHAINALYSIS BREACH JUST GOT MUCH WORSE! One of crypto's leading blockchain intelligence firms has confirmed exposure of password hashes and valid authentication tokens belonging to its users. 👉 Customer names, emails & user IDs exposed. 👉 Password hashes & live authentication tokens compromised. 👉 Actual passwords exposed for a subset of users. 👉 Reactor, Data Solutions & KYT services disrupted. Chainalysis says there's no evidence investigation data was accessed. The company is forcing password resets and API key rotations. A company trusted to investigate crypto crime is now dealing with a major security incident of its own. Stay SAFU.
Open source - TM
That Martini Guy ₿@MartiniGuyYTPost on X ·
Chainalysis has started restoring services following its cyberattack, but the latest disclosure is pretty serious. The company confirmed that names, usernames, password hashes and live tokens were exposed to a malicious actor. It says there's currently no evidence that investigation data was accessed or its attribution data manipulated. Access to KYT and Address Screening is now being restored in phases. Affected users will have to reset passwords and rotate API keys. This is another reminder that crypto security risks extend far beyond wallets and smart contracts.
Open source