On November 6, 2026, Beijing time, blockchain data company Chainalysis began to restore KYT and Address Screening services in stages, and stated that more customers would regain access in the next few hours. All users after recovery must reset their passwords and rotate API keys where applicable; customers will also need to submit a trusted IP address to be added to the allow list. At each stage, operations are monitored and enhanced security controls are verified before access is extended to remaining customers, the company said. Reactor and Data Solutions were still being reinforced and restored at the time, and officials did not say that all products had returned to normal.
Full user exposure and partial password events must be separated
This recovery comes after the company expanded its disclosure of the incident. Chainalysis said in a late-night update on November 4 that names, usernames, password hashes and live tokens involved all Chainalysis users and had been exposed to a malicious actor. The company said it discovered the information exposure the previous Monday and had removed access to Reactor and Data Solutions during the investigation. Officials did not announce the total number of users, nor did they indicate how many of these tokens were still valid when they were discovered, so "all users" cannot be converted into an undisclosed number of accounts or the scale of the damage.
The same incident also contained an on-path attack path with a different scope. Chainalysis said that some customers' passwords were exposed through this path. The company has contained and repaired this attack vector, and locked relevant accounts to require password resets. The "partial customer passwords" here cannot be merged with "all users' password hashes and live tokens", nor can it be written that all users' plaintext passwords have been stolen. Officials have not said which piece of infrastructure the path took place in.
Abnormal activities trigger multiple products to go offline
Chainalysis subsequently discovered unusual activity in its compliance monitoring products and took the KYT user interface and API, other Address Screening products, and the login page offline. The company said it had previously added proactive monitoring for unusual activity to its transaction monitoring products. The company also said that some KYT accounts appeared to have been accessed without authorization and that it was directly notifying the corresponding customers. The official wording remains "appeared to have been accessed"; it did not provide the number of accounts, the access period, the specific actions performed, or any resulting losses. At this stage, abnormal activity cannot be equated with confirmed asset losses.
The products were not taken offline all at once. On November 2, Chainalysis first suspended Reactor and Data Solutions while keeping its compliance transaction monitoring products running with added monitoring for unusual activity. After abnormal activity appeared on November 4, KYT, Address Screening, and the login page were also shut down, while Chain Beta remained offline. By November 6, KYT and Address Screening had only entered phased restoration, while the company and external security experts continued work on Reactor and Data Solutions.
Restore access by changing credentials first
The recovery process uses both network and account controls as access conditions. Chainalysis requires customers to submit trusted IP addresses through a designated email address or their account team, and it will confirm that each phase is operating as expected before expanding access. After regaining access, users need to reset their passwords and rotate API keys as applicable before they can register transactions. The company also asks users who receive a password-reset notification to go directly to the Chainalysis login page rather than click a link in the email; if the same password is used for other services, it should be changed there as well.
Regarding business data, Chainalysis still said in its latest update that it had no evidence that investigation data had been accessed or that the company’s attribution data had been manipulated. Its early report listed graphs, notes, and cases as examples of investigation content and said it had not found unauthorized access to transaction or query results at that time. This is the company's current investigative conclusion, not an independent audit, and it cannot be used to prove that every customer account went untouched. The company separately said this security incident was unrelated to the recent Binance cryptocurrency theft; the two incidents should not be presented as the same attack.
Latest investigation corrects early judgment
The company's initial notice on October 30 said it had found no unauthorized access to authentication credentials or session tokens at that time; the November 4 update confirmed that all users' password hashes and live tokens had been exposed. The two statements reflect information available at different stages of the investigation, with the later statement expanding and correcting the earlier disclosure. The chronology must be preserved: the October 30 preliminary assessment is no longer the latest conclusion, and the two versions cannot be treated as equally current.
Ars Technica's authorized public information feed published a headline, short summary, timestamp, and link on November 6, independently recording Chainalysis's statement that attackers obtained credentials and tokens affecting all customers. The official updates do not disclose the attacker's identity, the infrastructure involved in the on-path attack, whether the related communications were encrypted, the total number of customers, the precise scope of unauthorized access, or downstream losses. Chainalysis only characterized the methods as offensive techniques with agentic features and did not provide enough technical detail to determine the specific role of AI agents.