Chainalysis reboots Reactor and screening tools after hackers grabbed every user's login data

Chainalysis turned Reactor back on alongside KYT and Address Screening, announcing the restoration at 18:50 UTC on Nov. 7 and emailing customers instructions for reconnecting with tightened security. The Investigations API and Rapid Lookup stayed under maintenance as of Nov. 9. A dashboard snapshot captured earlier on Nov. 7, before that announcement, listed KYT's interface and API plus Address Screening as operational, with Reactor, Investigations API and Rapid Lookup marked under maintenance.

Access is being handed back in phases. Screening customers must reset passwords and rotate API keys where applicable before they can register transactions again, and a Nov. 6 set of restoration instructions told those who hadn't already done so to submit trusted IP addresses for Chainalysis's allowlist through their account team or support contact. Chainalysis said it was validating enhanced security controls as it went. An operational label on the dashboard didn't mean every screening customer was back up and running.

The breach turned out to be wider than first described. The original Oct. 30 notice covered accessed user IDs, names, email addresses and organization role labels. Then in a Nov. 4 update posted at 11 p.m. EST, Chainalysis said it had learned on Nov. 2 that names, usernames, password hashes and live login tokens belonging to all users had been exposed to a malicious actor. Password hashes are encoded password records; live tokens can keep someone signed in. The company noted that finding doesn't prove every account was accessed.

Abnormal activity on Nov. 4 pushed Chainalysis to take KYT, its other address-screening products and the login page offline, and it began notifying customers whose KYT accounts appeared to have been accessed without authorization. KYT monitors transactions, Address Screening gauges wallet risk exposure and Reactor is the tracing tool investigators use to follow funds across blockchains. Chainalysis said it still had no evidence that investigation data was accessed or attribution data manipulated, and its investigation continued.