Chainalysis Is Back Online. Recovery Still Takes Work
Matthew Leo · Published November 8, 2026 · Business & Policy
News analysis
Chainalysis says Reactor, KYT and Address Screening are back online after a disruptive security incident. That is a service-restoration milestone, not an all-clear for every customer account.
In a November 7 update timed at 1:50 p.m. EST, the company said the products had returned with enhanced security measures and that customers were being emailed specific reconnection instructions. Its incident page remains the primary source for the changing status.
The distinction is important because the company previously disclosed exposure of names, usernames, password hashes and live tokens for all users. BleepingComputer’s reporting independently covered that disclosure and the associated shutdowns.
Read the recovery instructions by date
On November 6, Chainalysis described a phased return for KYT and Address Screening. It asked organizations to supply trusted IP addresses for an allowlist and said users would need to reset passwords and rotate applicable API keys before registering transactions.
The newer November 7 notice says additional reconnection instructions are being sent. An older status update should not be used as a substitute for the current instructions for a particular organization.
The November 7 restoration paragraph names Reactor, KYT’s interface and API, and Address Screening. It does not name Data Solutions. Readers should not expand a product-specific statement into a claim that every service has returned to normal.
Three separate recovery checks
- Access: Confirm that the organization has been cleared to reconnect and that its expected users can sign in through the normal official destination.
- Credentials: Follow the required password reset and applicable API-key replacement process. Review any other account that reused an exposed password.
- Operations: Check whether integrations are actually processing expected work, rather than assuming a successful login means every downstream connection has recovered.
That last check is an operational precaution, not a report that Chainalysis integrations are failing. Organizations should coordinate credential changes with the owners of their connections so replacing a key does not silently interrupt a workflow.
What remains unknown
Chainalysis says it has no evidence that investigation data was accessed or attribution data manipulated. “No evidence” describes the investigation’s current findings; it is not an independent guarantee that nothing else occurred.
The company has not publicly explained every technical aspect of the exposed tokens. Customers should obtain account-specific answers from their established support contact rather than infer the scope from a generic breach headline.