Chainalysis Reopens Compliance Tools With Mandatory Credential Resets

Chainalysis has brought its crypto compliance tools back online after a breach, but customers must reconnect through trusted-IP allowlists and reset credentials before submitting transactions again under its phased restoration plan.

The blockchain analytics company began restoring KYT and Address Screening access on Nov. 6. Its Saturday update said Reactor was also back online. On Monday, Nov. 9, it reiterated in a public reply: “Compliance products are back online now.”

KYT monitors cryptocurrency transactions for risk, while Address Screening assesses wallet risk exposure. Customers that have not submitted trusted IP addresses must send them to support or their account team for the allowlist. Once admitted, all users must reset passwords and rotate API keys, as applicable, before registering transactions.

The company's reconnection instructions say old passwords have expired and prior API keys no longer work. KYT and Address Screening integration managers must generate replacement keys and use them in their integrations.

The recovery is not complete across the platform. As of Monday afternoon, Chainalysis's status page listed KYT's interface and API, Address Screening and Reactor as operational, but the Investigations API and Rapid Lookup remained under maintenance. Its latest Sunday update said the Customer Admin Portal and Training Academy were still unavailable.

Credentials Exposed Across the User Base

In its Nov. 4 disclosure, Chainalysis said it had discovered on Nov. 2 that names, usernames, password hashes and “live tokens” for all Chainalysis users had been exposed to a malicious actor.

The company initially kept its transaction-monitoring products running while taking Reactor and Data Solutions offline. It then shut down KYT's interface and API, other address-screening products and the login page on Nov. 4 after detecting abnormal activity. It said it was directly notifying customers whose KYT accounts appeared to have been accessed without authorization.

The disclosure did not specify how many KYT accounts appeared to have been accessed or what the exposed “live tokens” covered. In the Nov. 4 update, Chainalysis said it continued to have no evidence that investigation data had been accessed or its attribution data manipulated.

Bridge Transfers Hit by the Outage

The disruption also affected a downstream bridge, according to Metallicus CEO Marshall Hayner. Responding Sunday to a user reporting trouble transferring from Metal Pay to WebAuth, he wrote: “We are awaiting Chainalysis to turn back online and the bridge should be resumed shortly.”

Chainalysis's Monday confirmation came in reply to Hayner, but did not confirm the bridge had resumed. Metal Pay's status page still listed cryptocurrency deposits and withdrawals as under maintenance on Monday.