Chainalysis Restored KYT in Phases. Its Customers Are Still Rotating API Keys.
Chainalysis began phased restoration of its KYT and address-screening tools on November 6, a week after detecting unauthorized activity in its internal systems. By November 4 it was telling customers that names, usernames, password hashes and live tokens had been exposed. The real story isn't the breach. It's how much of crypto's compliance work runs through one vendor.
Chainalysis started bringing its Know Your Transaction and address-screening products back online on November 6, a week after it first found unauthorized activity inside its internal systems. The restoration is phased, and that word is doing real work. Access expands only as the firm's new security controls clear validation.
The disclosures got worse as the week went on. The October 30 statement said there was no evidence of access to sensitive material. By November 4, customers were being told that names, usernames, password hashes and live tokens had been exposed. Live tokens are the detail compliance officers should sit with. A token doesn't need a password. It's already authenticated, and it works until someone kills it.
Customers were asked to submit trusted IP addresses for allowlisting, prepare password resets and rotate API keys. Missing from the November 6 notice: a confirmed timetable for Reactor, and any statement that every affected product is fully back. Chainalysis also said it had no evidence that investigation content was accessed or that attribution data was manipulated. That's a narrower claim than "nothing else happened," and it should be read that way.
Here's the part the industry needs to absorb. Crypto's compliance stack runs through a handful of vendors. Hundreds of exchanges, custodians and payment processors use the same screening tools to decide whether to accept a deposit or clear an onboarding request. When one goes dark for a week, the chain keeps producing blocks and the auditors keep asking for answers.
The FDA doesn't care about your chain. It cares about your audit trail. Swap FDA for any regulator with subpoena power and the logic holds. An outage isn't just an inconvenience for a compliance team. It's a documented gap in the record, and gaps are precisely what examiners open with.
So watch for independent assurance that the exposed credentials are actually invalidated, not just rotated. And expect procurement teams to start demanding a second screening vendor as a condition of the contract. That's a real cost. It's also cheaper than explaining a seven-day hole in your transaction monitoring to a supervisor.