Crypto’s crime-tracking giant restores its main tools after hackers exposed every user’s login data

Blockchain analytics company Chainalysis has restored Reactor, KYT and Address Screening after a security incident exposed account information for all its users. Its Investigations API and Rapid Lookup services remained under maintenance on Nov. 9.

The company announced the return of Reactor and its screening products at 18:50 UTC on Nov. 7, saying it was emailing customers instructions for reconnecting with enhanced security measures.

The snapshot below records the earlier Nov. 7 position before that restoration announcement, not the current status.

The service dashboard listed KYT's interface and API, along with Address Screening, as operational on Nov. 7. Reactor, Investigations API and Rapid Lookup were under maintenance. Those operational labels therefore do not mean every screening customer has regained access.

KYT monitors transactions, Address Screening assesses wallet risk exposure, and Reactor helps investigators trace funds across blockchains. Reactor has since returned, while the Investigations API and Rapid Lookup outages continue.

What customers need before resuming screening

In its Nov. 6 restoration instructions, Chainalysis asked customers who had not already done so to submit trusted IP addresses for its allowlist through their account team or support contact.

Those instructions required users to reset passwords and rotate applicable API keys after access was granted and before registering transactions.

Chainalysis said it was validating enhanced security controls during the phased restoration. The later Nov. 7 announcement confirmed Reactor had returned alongside KYT and Address Screening.

The recovery follows disclosures that went beyond the initial identity-data exposure covered by CryptoSlate on Oct. 31. The original Oct. 30 notice listed accessed user IDs, names, email addresses and organization role labels.

In a Nov. 4 update at 11 p.m. EST, Chainalysis said it had discovered on Nov. 2 that names, usernames, password hashes and live login tokens for all users had been exposed to a malicious actor. Password hashes are encoded password records; live tokens can keep a user signed in. That disclosure does not establish that every account was accessed.

The company also said abnormal activity on Nov. 4 prompted it to take KYT, other address-screening products and the login page offline. It was notifying customers whose KYT accounts appeared to have been accessed without authorization.

In that Nov. 4 update, Chainalysis continued to say it had no evidence investigation data had been accessed or attribution data manipulated. Its investigation was ongoing.