Chainalysis Reopens Reactor and KYT After Breach Exposed Every User's Tokens

Chainalysis switched Reactor, KYT (its interface and API) and Address Screening back on November 7. Access came with strings attached: customers first had to submit approved network IP addresses, reset passwords and swap out applicable API keys before they could register transactions. A November 8 status notice still flagged the Customer Admin Portal and Training Academy as down, and the firm had not confirmed full restoration of Data Solutions. Reconnection instructions went out by email, with a live dashboard tracking updates.

The trouble started October 30, when Chainalysis disclosed that an unauthorized person used what it called "offensive agentic techniques" to reach its infrastructure and internal systems. The company has not said which AI tools were involved or how the intruder got in. By November 4, it found that names, usernames, password hashes and live tokens for all users had been exposed, though that does not mean every account was opened. Chainalysis also caught an "on-path" attack that intercepted some customer passwords, says it shut that method down, and is directly notifying customers whose KYT accounts appear to have been accessed without authorization. So far it has found no sign that investigation materials were touched or its blockchain attribution data manipulated; the probe continues.

Chainalysis counts the FBI, Coinbase and Barclays among its customers, which is why a dark screen matters far beyond one vendor. When the screening service goes offline, checks on suspicious wallets and transactions can slow across many institutions at once. There is no evidence this incident halted transactions or triggered compliance violations. In October, Financial Stability Board Secretary General John Schindler warned that a disruption at a single provider can ripple across institutions and borders.

The wider numbers keep the stakes high. TRM Labs put illicit crypto flows at $158 billion in 2025, up nearly 145%, with hackers stealing $2.87 billion across almost 150 incidents, even as illicit activity's share of total crypto volume slipped to 1.2%, down from 1.3%. Verizon's 2026 report found system intrusions in 61% of the breaches it studied, though it did not examine this attack. Stricter rules are coming too: PwC's 2027 report points to the EU Anti-Money Laundering Regulation kicking in from July 2027 and the UK's crypto regime going live in October.

Competition in blockchain monitoring is already sharp. Cryptopolitan reported that Chainalysis challenged a $94.66 million US Immigration and Customs Enforcement contract handed to rival TRM Labs. Chainalysis has not said how many KYT accounts may have been accessed, nor put a dollar figure on any wider loss. For now, the documented damage is exposed credentials, disrupted services and a slow, step-by-step reopening.