Chainalysis resumes KYT screening after exposing user password hashes

Chainalysis announced on November 6 that it is restoring access to its Know Your Transaction (KYT) and address screening products through a phased process. The decision follows a cyberattack that resulted in the exposure of user data, including names, usernames, password hashes, and live tokens.

Timeline of Disclosures

The company’s public communications regarding the incident evolved over several days. Chainalysis initially reported discovering unauthorized activity affecting its internal systems and tools. An October 30 statement indicated that, at that time, there was no evidence of access to certain sensitive materials.

However, a November 4 update disclosed that user information had been exposed to an attacker. The specific data points identified in this later disclosure included names, usernames, password hashes, and live tokens. The company also reported abnormal activity around KYT and other screening tools, which prompted additional products to be taken offline to mitigate risk.

As of the November 6 update, Chainalysis stated it had no evidence of access to investigation content or manipulation of its attribution data. This claim is narrower than a declaration that every possible effect has been ruled out, reflecting the ongoing nature of the forensic investigation.

Customer Actions and Restoration Process

Chainalysis instructed customers to submit trusted IP addresses for allowlisting as part of the restoration process. Users were also told to prepare to reset passwords and rotate API keys as access to the platform is reinstated. The company emphasized that restoration would expand only as it validated enhanced security controls.

The distinction between password hashes and plaintext passwords is a key technical detail in this incident. While a hash is not the same as a plaintext password, exposed hashes create security concerns depending on how they were generated and the strength of the underlying credentials. Live tokens present a separate risk because they may enable access to systems while they remain valid.

As of the November 6 announcement, Chainalysis had not confirmed the full restoration of every affected product. The complete scope of exposure, the specific remedial actions taken, and the timetable for restoring other products, such as Reactor, remain open questions. Independent assurance that compromised credentials have been invalidated is also a pending item for customers and regulators to monitor.