Chainalysis said in a Nov. 4, 2026 update that password hashes and live authentication tokens for all users had been exposed to an attacker, expanding on its Oct. 30 report of compromised customer information. It also reported suspicious activity in its transaction-screening systems and said it was notifying customers whose accounts appeared to have been accessed without authorization. The company said it had found no evidence that confidential investigation data was accessed or blockchain attribution data was changed; it did not say whether the exposed tokens had been used to access more accounts.
Chainalysis took its KYT transaction-monitoring platform, address-screening products, Reactor investigation platform and other services offline. It planned to begin restoring KYT and address-screening access on Nov. 5 through a system requiring customers to provide trusted IP addresses, with password resets and API-key rotation required as appropriate during restoration.
