Chainalysis Restores Reactor, KYT and Address Screening After Multifront Cyberattack

Chainalysis has brought Reactor, KYT and Address Screening — the blockchain-screening tools that exchanges, banks and investigators rely on — back online as of November 7, following a cyberattack that exposed account information and active login tokens for all of its users. The blockchain analytics firm serves major clients, including the FBI, Coinbase and Barclays. Reopening the tools, however, is only part of the recovery: customers must still complete additional security checks before they can regain full access.

An external actor and “offensive agentic techniques”

Chainalysis disclosed the incident on October 30, saying that an unauthorized actor made use of “offensive agentic techniques” — a reference to AI-driven attack methods — to access the company’s infrastructure and internal safeguards. The firm has not revealed the specific AI tools involved or how the attacker gained entry.

By November 4, Chainalysis had determined that names, usernames, password hashes and live tokens for all users had been exposed — although that does not mean every account was actually accessed.

The company also uncovered an “on-path” attack that intercepted some customer passwords. Chainalysis said it has thwarted that method and is contacting affected clients directly. “We are directly notifying customers whose KYT accounts appear to have been accessed without authorization,” the company stated.

To date, Chainalysis has found no evidence that investigation materials were accessed or that its blockchain attribution data was manipulated. The investigation remains underway.

Software back online, access still gated

The company confirmed that Reactor, the KYT interface and API, and Address Screening were operational again on November 7. Customers could not resume work immediately, though. Under the phased reopening, they were required to submit approved network IP addresses, reset passwords and replace applicable API keys before registering transactions.

A November 8 status notice still listed the Customer Admin Portal and Training Academy as unavailable, and Chainalysis had not confirmed the full restoration of Data Solutions. The firm has emailed reconnection instructions, and customers can monitor its live dashboard for updates.

Why one vendor’s outage ripples outward

The disruption highlights a structural risk for exchanges, banks and investigators that depend on the same blockchain-screening provider: when the service goes offline, checks on suspicious wallets and transactions can slow across multiple institutions at once. There is no evidence, however, that this incident halted transactions or caused compliance violations.

In October, John Schindler, Secretary General of the Financial Stability Board, warned that disruptions at a single provider can affect multiple institutions across borders. As cryptocurrency regulation tightens, that concentration risk carries even greater weight. According to the 2027 PwC report, the EU Anti-Money Laundering Regulation begins introducing its provisions in July 2027, while the UK’s crypto regime goes live starting in October. Separately, Verizon’s 2026 report found system intrusions in 61% of the breaches studied — though that research did not examine the Chainalysis attack.

A market already fighting over contracts

TRM Labs estimated illicit crypto flows at $158 billion in 2025, an increase of nearly 145%. Hackers stole $2.87 billion across close to 150 incidents. Even so, illicit activity’s share of overall crypto volume fell from 1.3% to 1.2%.

Competition among blockchain-monitoring firms is fierce. Cryptopolitan reported that Chainalysis challenged a $94.66 million US Immigration and Customs Enforcement contract awarded to rival TRM Labs. The breach now raises questions about reliability in a business built on trust.

Chainalysis has not disclosed how many KYT accounts may have been accessed or quantified any wider financial loss. For now, the documented impact consists of exposed credentials, disrupted services and a gradual reopening. The open items going forward are full restoration of the Customer Admin Portal, Training Academy and Data Solutions, the direct notifications to customers whose accounts appear to have been accessed, and the findings of the investigation still underway.