What happened
Chainalysis said on 4 November 2026 that names, usernames, password hashes and live tokens for all users had been exposed to a malicious actor. It separately said an on-path attack exposed a subset of customer passwords and that abnormal activity led it to take KYT, Address Screening, the login page, Reactor and Data Solutions offline. Chainalysis also said some KYT accounts appeared to have been accessed without authorisation, while it had no evidence that investigation data was accessed or attribution data manipulated.
On 6 November 2026, Chainalysis began phased restoration of KYT and Address Screening behind trusted-IP allowlisting, mandatory password resets and API-key rotation. On 7 November 2026, Chainalysis said Reactor, KYT and Address Screening were back online with enhanced security measures. Restoration is therefore not ordinary service recovery: customer identity administrators and compliance operations teams must complete the reconnect controls before accepting the platform as operationally restored.
The public incident page is not internally reconciled: its later update says live tokens for all users were exposed, while an older section still says no user session tokens were accessed. Chainalysis did not publish a customer or user count. No IP addresses, domains, hashes, agent or framework name, or underlying model were published. Attribution posture: Chainalysis describes an external malicious actor using offensive agentic techniques but has not named or attributed that actor.
Why this matters now
The incident affects an external platform used for transaction screening, address screening and investigations, but the immediate control failure is identity-related. Password hashes and live tokens for all users, a subset of intercepted passwords and apparently unauthorised KYT access require a tenant-specific containment record even where the supplier says services are restored.
The Saturday restoration changes the operational decision. Compliance teams can resume workflows, but only after identity owners complete the supplier’s trusted-IP, password-reset and API-key requirements. Reconnecting without those controls would turn availability recovery into an unmanaged credential exception.
The platform’s role in financial-crime controls creates a resilience dependency beyond ordinary SaaS inconvenience. Security leaders need evidence that monitoring gaps, delayed registrations or manual workarounds during the outage have been reconciled, while avoiding any unsupported claim that investigation or attribution data was altered.
The decision for security leaders
Assign identity owners to complete and evidence password resets, API-key rotation and session invalidation for every enterprise user and service integration. Do not accept a vendor-wide restoration message as proof that the organisation’s tenant has completed containment.
Assign the financial-crime or compliance owner to validate that KYT, Address Screening and investigation workflows are functioning, then reconcile transactions, registrations or alerts processed through manual contingencies during the disruption.
Assign vendor risk to obtain written clarification of token scope, unauthorised account activity, full product-restoration status and the boundary around investigation and attribution data. Record any unanswered question as an assurance limitation with an owner and deadline.
Evidence of closure
- The identity register shows password reset completion for every Chainalysis user.
- The secrets register records replacement and validation of every Chainalysis API key.
- Tenant logs have a documented disposition for every suspicious login or KYT event.
- Compliance owners sign off reconciliation of transactions processed during disruption or manual fallback.
The Security.io assessment
The weekend development is recovery under additional controls, not incident closure. Chainalysis has restored key services, but the need for trusted IPs, password resets and API-key rotation shows that customer-side identity work remains part of the restoration sequence.
The unreconciled public language around live tokens and user session tokens is material. Until Chainalysis explains whether the phrases describe different artefacts, customers should take the broader exposure statement as the containment basis without claiming that every session was used.
No public indicators or complete user count are available, which limits independent scoping. Customer audit logs, identity records, API usage and the vendor’s direct tenant notification are therefore more valuable than generic threat-intelligence feeds for proving closure. Chainalysis did not identify a specific underlying attacker-side AI model. Chainalysis did not disclose the attacker’s AI-tool configuration or degree of human supervision. Chainalysis reported unauthorized access to its systems and internal tools but did not specify which intrusion steps involved AI.
Questions for the morning meeting
- Has every Chainalysis user completed the required password reset?
- Have all Chainalysis API keys been rotated and dependent integrations retested?
- Can the vendor explain the difference between exposed live tokens and user session tokens?
- What manual controls cover transaction screening if access is withdrawn again?