Crypto’s crime-tracking giant restores its main tools after hackers exposed every user’s login data

Blockchain analytics company Chainalysis has restored Reactor, KYT and Address Screening after a security incident exposed account information for all its users. Its Investigations API and Rapid Lookup services remained under maintenance on Nov. 9.

The company announced the return of Reactor and its screening products at 18:50 UTC on Nov. 7, saying it was emailing customers instructions for reconnecting with enhanced security measures.

The snapshot below records the earlier Nov. 7 position before that restoration announcement, not the current status.

The service dashboard listed KYT's interface and API, along with Address Screening, as operational on Nov. 7. Reactor, Investigations API and Rapid Lookup were under maintenance. Those operational labels therefore do not mean every screening customer has regained access.

What access requires

KYT and Address Screening access is phased. Once access is granted, all users must reset passwords and rotate API keys as applicable before registering transactions.

An operational screening label does not mean every customer is ready to register transactions.

Status is time-bound to the captured November 7 updates. Customer counts, completion percentages and an investigation-service restoration deadline are not supplied. A required action in the diagram is not a claim that every customer has completed it.

Sources and evidence

Sources

1. Nov. 7 incident update, 15:07 UTC
2. Service-component status, captured Nov. 7
3. Nov. 6 restoration and credential instructions

Supporting facts

• Chainalysis said at 15:07 UTC on November 7, 2026 that it was still bringing customers onto KYT and Address Screening while working to return all products to typical operation. [1]
• Chainalysis's status page on November 7 labelled KYT API, KYT UI and Address Screening operational, while Reactor, Investigations API and Rapid Lookup were under maintenance. [2]
• Operational labels on Chainalysis's screening components did not establish restored access for every customer: its concurrent incident update said customer onboarding was still in progress. [2] [1]
• Chainalysis's November 6 disclosure said it had begun phased restoration of KYT and Address Screening and would expand access as each phase's operation and enhanced security controls were validated. [3]
• Chainalysis instructed customers to send trusted IP addresses to its support or account team for allowlisting, if they had not already done so. [3]
• Chainalysis said all users must reset passwords and rotate API keys as applicable once access is granted, before registering transactions. [3]

Method

Map the captured Nov. 7 component status and incident narrative, then sequence the Nov. 6 customer instructions. Diagram paths show service access and required actions, not elapsed time or a completion percentage. No new calculations.

Scope

Status is time-bound to the captured November 7 updates. Customer counts, completion percentages and an investigation-service restoration deadline are not supplied. A required action in the diagram is not a claim that every customer has completed it.

Infographic by CryptoSlate

KYT monitors transactions, Address Screening assesses wallet risk exposure, and Reactor helps investigators trace funds across blockchains. Reactor has since returned, while the Investigations API and Rapid Lookup outages continue.

What customers need before resuming screening

In its Nov. 6 restoration instructions, Chainalysis asked customers who had not already done so to submit trusted IP addresses for its allowlist through their account team or support contact.

Those instructions required users to reset passwords and rotate applicable API keys after access was granted and before registering transactions.

Chainalysis said it was validating enhanced security controls during the phased restoration. The later Nov. 7 announcement confirmed Reactor had returned alongside KYT and Address Screening.

The recovery follows disclosures that went beyond the initial identity-data exposure covered by CryptoSlate on Oct. 31. The original Oct. 30 notice listed accessed user IDs, names, email addresses and organization role labels.

In a Nov. 4 update at 11 p.m. EST, Chainalysis said it had discovered on Nov. 2 that names, usernames, password hashes and live login tokens for all users had been exposed to a malicious actor. Password hashes are encoded password records; live tokens can keep a user signed in. That disclosure does not establish that every account was accessed.

The company also said abnormal activity on Nov. 4 prompted it to take KYT, other address-screening products and the login page offline. It was notifying customers whose KYT accounts appeared to have been accessed without authorization.

In that Nov. 4 update, Chainalysis continued to say it had no evidence investigation data had been accessed or attribution data manipulated. Its investigation was ongoing.