Blockchain analytics firm Chainalysis has brought three of its core products back online, a week after a cyberattack forced it to shut them down. Reactor, its investigation tool, and KYT, its transaction-monitoring service, are running again alongside Address Screening, the company said in an update on Saturday 7 November.

The restoration marks a turn in an incident that began on 30 October, when Chainalysis first disclosed that an outside actor had gained unauthorised access to its systems and internal tools. The company described the intrusion as an attack using what it called offensive agentic techniques, and said it had brought in outside cybersecurity experts to investigate and harden its systems.

In its latest update, published at 1:50pm Eastern time on 7 November, Chainalysis said the three products had been restored with enhanced security measures. Customers are being emailed instructions on how to reconnect in a specific way, to keep accounts and data protected. The company thanked customers for their patience, saying it knew the week had been difficult.

What was exposed

The picture of what the attackers reached grew steadily worse during the first week. The 30 October notice said there was no evidence that investigation content, authentication credentials or session tokens had been accessed, and that only names, email addresses, user IDs and role labels had been taken.

That account changed on 4 November. In an update published late that evening, Chainalysis said it had discovered on Monday 2 November that names, usernames, password hashes and live tokens covering all of its users had been exposed to a malicious actor. A live token can let someone act as a signed-in user without knowing the password, which made the disclosure far more serious than the first notice suggested.

The same day, the company told some customers that an on-path attack, in which an attacker sits between a user and the service, had exposed a subset of customer passwords. It said that attack route had been contained and fixed, and locked the affected accounts as a precaution.

Chainalysis has not said whether every type of data was exposed for every user, and it has not identified the attacker or published a user count. It continues to say it has no evidence that any investigations data was accessed or that its attribution data was manipulated.

Services taken offline, then restored

As the investigation widened, Chainalysis took Reactor and Data Solutions offline on 2 November as a precaution. On 4 November it also shut down KYT, both its user interface and its programming interface, together with its other address-screening products and its login page, after detecting further abnormal activity.

Restoration began in phases on 6 November, when KYT and Address Screening started coming back for customers who supplied trusted IP addresses for an allowlist. The 7 November update completed that step, bringing Reactor back as well.

Every user will still have to reset their password and rotate API keys before using the services again, and customers whose KYT accounts appear to have been accessed without authorisation are being notified directly. The company has not said in its update when Data Solutions and its Chain (Beta) product will return.

Chainalysis stressed again that the incident is not related to the recent theft of cryptocurrency from Binance. For customers, the practical message is unchanged: follow the reconnection instructions in the email from the company, reset passwords, rotate keys, and do not reuse a Chainalysis password anywhere else. Full details are in Chainalysis's incident notice.