Blockchain analytics company Chainalysis has restored its Reactor, KYT and Address Screening services after a security incident exposed account information for all its users. The company announced the return of Reactor and its screening products at 18:50 UTC on Nov. 7, saying it was emailing customers instructions for reconnecting with enhanced security measures.
As of Nov. 9, Chainalysis’s Investigations API and Rapid Lookup services remained under maintenance, while Reactor was operational.
Phased access and required actions
Access to KYT and Address Screening is being phased. Once access is granted, all users must reset passwords and rotate API keys as applicable before registering transactions. An operational screening label does not mean every customer is ready to register transactions.
In its Nov. 6 restoration instructions, Chainalysis asked customers who had not already done so to submit trusted IP addresses for its allowlist through their account team or support contact. Those instructions required users to reset passwords and rotate applicable API keys after access was granted and before registering transactions. Chainalysis said it was validating enhanced security controls during the phased restoration.
Scope of the exposure
The recovery follows disclosures that went beyond the initial identity-data exposure covered by CryptoSlate on Oct. 31. The original Oct. 30 notice listed accessed user IDs, names, email addresses and organization role labels.
In a Nov. 4 update at 11 p.m. EST, Chainalysis said it had discovered on Nov. 2 that names, usernames, password hashes and live login tokens for all users had been exposed to a malicious actor. Password hashes are encoded password records; live tokens can keep a user signed in. That disclosure does not establish that every account was accessed.
The company also said abnormal activity on Nov. 4 prompted it to take KYT, other address-screening products and the login page offline. It was notifying customers whose KYT accounts appeared to have been accessed without authorization.
In that Nov. 4 update, Chainalysis continued to say it had no evidence investigation data had been accessed or attribution data manipulated. Its investigation was ongoing.
Service functions
KYT monitors transactions, Address Screening assesses wallet risk exposure, and Reactor helps investigators trace funds across blockchains. Reactor has since returned, while the Investigations API and Rapid Lookup outages continue.
