Crypto’s crime-tracking giant restores its main tools after hackers exposed every user’s login data

Blockchain analytics company Chainalysis has restored Reactor, KYT and Address Screening after a security incident exposed account information for all its users. Its Investigations API and Rapid Lookup services remained under maintenance on Nov. 9.

The company announced the return of Reactor and its screening products at 18:50 UTC on Nov. 7, saying it was emailing customers instructions for reconnecting with enhanced security measures.

The snapshot below records the earlier Nov. 7 position before that restoration announcement, not the current status.

The service dashboard listed KYT's interface and API, along with Address Screening, as operational on Nov. 7. Reactor, Investigations API and Rapid Lookup were under maintenance. Those operational labels therefore do not mean every screening customer has regained access.

Screening is operational. Access is still returning.

Chainalysis's Nov. 7 status separates service-component availability from customer access. Screening is returning in phases while investigation tools remain under maintenance.
Securityrecovery SCREENING Operational components KYT API / UI · Address Screening Access returning Customer by customer INVESTIGATIONS Under maintenance Reactor · Investigations API · Rapid Lookup Accessunavailable
Security recovery SCREENING Operational components KYT API / UIAddress Screening Access returning in phases INVESTIGATIONS Under maintenance Reactor · Investigations APIRapid Lookup Access unavailable

What access requires

What access requiresScreeningInvestigations
KYT and Address Screening access is phased. Once access is granted, all users must reset passwords and rotate API keys as applicable before registering transactions.
Before registering transactions KYT and Address Screening 1234 Submit trusted IPs For the allowlist Access granted Restoration is phased Reset passwords Rotate API keys as applicable Then register transactions
Before registeringtransactions 1234 Submit trusted IPsFor the allowlist Access grantedRestoration is phased Reset passwordsRotate API keysas applicable Then register transactions After the required changes
Reactor, Investigations API and Rapid Lookup remain under maintenance in the captured Nov. 7 status.
Investigation access remains on hold Status observed Nov. 7, 2026 Reactor Investigations API Rapid Lookup Under maintenance Customer access unavailable
Investigation accessremains on hold ReactorInvestigations APIRapid Lookup Under maintenanceCustomer access unavailable Status observed Nov. 7, 2026

An operational screening label does not mean every customer is ready to register transactions.

Status is time-bound to the captured November 7 updates. Customer counts, completion percentages and an investigation-service restoration deadline are not supplied. A required action in the diagram is not a claim that every customer has completed it.
Sources and evidence

Sources

1. Nov. 7 incident update, 15:07 UTC
2. Service-component status, captured Nov. 7
3. Nov. 6 restoration and credential instructions

Supporting facts

• Chainalysis said at 15:07 UTC on November 7, 2026 that it was still bringing customers onto KYT and Address Screening while working to return all products to typical operation. [1]
• Chainalysis's status page on November 7 labelled KYT API, KYT UI and Address Screening operational, while Reactor, Investigations API and Rapid Lookup were under maintenance. [2]
• Operational labels on Chainalysis's screening components did not establish restored access for every customer: its concurrent incident update said customer onboarding was still in progress. [2] [1]
• Chainalysis's November 6 disclosure said it had begun phased restoration of KYT and Address Screening and would expand access as each phase's operation and enhanced security controls were validated. [3]
• Chainalysis instructed customers to send trusted IP addresses to its support or account team for allowlisting, if they had not already done so. [3]
• Chainalysis said all users must reset passwords and rotate API keys as applicable once access is granted, before registering transactions. [3]

Method

Map the captured Nov. 7 component status and incident narrative, then sequence the Nov. 6 customer instructions. Diagram paths show service access and required actions, not elapsed time or a completion percentage. No new calculations.

Scope

Status is time-bound to the captured November 7 updates. Customer counts, completion percentages and an investigation-service restoration deadline are not supplied. A required action in the diagram is not a claim that every customer has completed it.
Infographic by CryptoSlate

KYT monitors transactions, Address Screening assesses wallet risk exposure, and Reactor helps investigators trace funds across blockchains. Reactor has since returned, while the Investigations API and Rapid Lookup outages continue.

What customers need before resuming screening

In its Nov. 6 restoration instructions, Chainalysis asked customers who had not already done so to submit trusted IP addresses for its allowlist through their account team or support contact.

Those instructions required users to reset passwords and rotate applicable API keys after access was granted and before registering transactions.

Chainalysis said it was validating enhanced security controls during the phased restoration. The later Nov. 7 announcement confirmed Reactor had returned alongside KYT and Address Screening.

The recovery follows disclosures that went beyond the initial identity-data exposure covered by CryptoSlate on Oct. 31. The original Oct. 30 notice listed accessed user IDs, names, email addresses and organization role labels.

In a Nov. 4 update at 11 p.m. EST, Chainalysis said it had discovered on Nov. 2 that names, usernames, password hashes and live login tokens for all users had been exposed to a malicious actor. Password hashes are encoded password records; live tokens can keep a user signed in. That disclosure does not establish that every account was accessed.

The company also said abnormal activity on Nov. 4 prompted it to take KYT, other address-screening products and the login page offline. It was notifying customers whose KYT accounts appeared to have been accessed without authorization.

In that Nov. 4 update, Chainalysis continued to say it had no evidence investigation data had been accessed or attribution data manipulated. Its investigation was ongoing.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.