Blockchain analytics firm Chainalysis has confirmed that hackers accessed customer data in a security update. The compromised information includes names, usernames, password hashes, and active authentication tokens belonging to all platform users.
The incident led to the operational shutdown of several of the company’s core tools, including the suspension of its flagship investigation platform with no clear recovery timeline.
How the Attackers Breached the System
Traces of the breach were first detected on October 30, 2026. External attackers leveraged offensive agent-based techniques to infiltrate Chainalysis’s internal systems and work tools.
A follow-up investigation on November 4, 2026, revealed a communication-path attack method, or on-path attack. Through this data traffic interception method, the attackers intercepted passwords belonging to some customers as they communicated with the system.
To trace the attack vector and expedite the internal investigation, management brought in a third-party cybersecurity firm as well as large language models (LLMs) to close the vulnerabilities exploited by the hackers.
Reactor Suspension and KYT Service Shutdown
Two days before the on-path attack findings were announced, Chainalysis suspended operations of its Reactor and Data Solutions investigation platforms as of November 2, 2026. A thorough security audit was initiated with no firm reopening deadline.
The situation escalated on November 4, 2026, when suspicious activity was detected on the Know Your Transaction (KYT) service. The findings within the transaction monitoring system prompted the shutdown of the web interface, KYT API, address screening feature, and the platform’s main login page.
Despite public access being shut off, Chainalysis stated that it found no evidence of tampering with blockchain attribution data. The company also emphasized that there was no unauthorized access to users’ investigation history during the attack.
IP Whitelist Requirements and API Key Rotation
Access to KYT services and address screening only began reopening gradually on November 5, 2026. This access restoration was restricted via an IP address whitelist specifically for customers who had completed the verification process.
Alongside the phased restoration of access, the company required all users to perform a mass password reset and rotate all API keys connected to the system.
For platform users, continuing transaction monitoring now requires completing IP verification and updating login credentials before the system can be used again.
Reported by crypto.news.
Also read: Hackers Infiltrate via Fake Teams Meeting Invites - Binance and Deribit Revoke SignalPlus API Access
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
