Chainalysis has brought its cryptocurrency compliance tools back online following a breach, but customers must reconnect through trusted-IP allowlists and reset their credentials before submitting transactions again, under the blockchain analytics firm's phased restoration plan.

The company began restoring access to KYT and Address Screening on Nov. 6, and a Saturday update confirmed that Reactor was also back online. On Monday, Nov. 9, Chainalysis reiterated the progress in a public reply: “Compliance products are back online now.”

Mandatory Reconnection Steps

KYT monitors cryptocurrency transactions for risk, while Address Screening assesses wallet risk exposure. Customers who have not submitted trusted IP addresses must send them to support or their account team for inclusion on the allowlist, which restricts access to pre-approved network addresses. Once admitted, all users must reset passwords and rotate API keys, as applicable, before registering transactions.

Chainalysis's reconnection instructions state that old passwords have expired and prior API keys no longer work, so credentials issued before the restoration cannot be used to reconnect. KYT and Address Screening integration managers must generate replacement keys and use them in their integrations.

Recovery Not Complete Across the Platform

Restoration remains partial. As of Monday afternoon, Chainalysis's status page listed KYT's interface and API, Address Screening and Reactor as operational, while the Investigations API and Rapid Lookup remained under maintenance. The company's most recent Sunday update said the Customer Admin Portal and Training Academy were still unavailable.

Credentials Exposed Across the User Base

In its Nov. 4 disclosure, Chainalysis said it had discovered on Nov. 2 that names, usernames, password hashes and “live tokens” for all Chainalysis users had been exposed to a malicious actor. The reconnection requirements span that same full user base.

The company initially kept its transaction-monitoring products running while taking Reactor and Data Solutions offline. It then shut down KYT's interface and API, its other address-screening products and the login page on Nov. 4 after detecting abnormal activity. Chainalysis said it was directly notifying customers whose KYT accounts appeared to have been accessed without authorization.

The disclosure did not specify how many KYT accounts appeared to have been accessed or what the exposed “live tokens” covered. In the Nov. 4 update, the company said it continued to have no evidence that investigation data had been accessed or its attribution data manipulated.

Bridge Transfers Hit by the Outage

The disruption also affected a downstream bridge, according to Metallicus CEO Marshall Hayner. Responding on Sunday to a user reporting trouble transferring from Metal Pay to WebAuth, he wrote: “We are awaiting Chainalysis to turn back online and the bridge should be resumed shortly.”

Chainalysis's Monday confirmation came in reply to Hayner, but the company did not confirm that the bridge had resumed. Metal Pay's status page still listed cryptocurrency deposits and withdrawals as under maintenance on Monday. Restoring the Investigations API, Rapid Lookup, Customer Admin Portal and Training Academy, and confirming that the bridge has resumed, remain the open items in the recovery.