Blockchain analytics company Chainalysis has restored Reactor, KYT and Address Screening after a security incident exposed account information for all its users. Its Investigations API and Rapid Lookup services remained under maintenance on Nov. 9.
The company announced the return of Reactor and its screening products at 18:50 UTC on Nov. 7, saying it was emailing customers instructions for reconnecting with enhanced security measures.
The snapshot below records the earlier Nov. 7 position before that restoration announcement, not the current status.
The service dashboard listed KYT’s interface and API, along with Address Screening, as operational on Nov. 7. Reactor, Investigations API and Rapid Lookup were under maintenance. Those operational labels therefore do not mean every screening customer has regained access.
What access requires
What access requiresScreeningInvestigations
KYT and Address Screening access is phased. Once access is granted, all users must reset passwords and rotate API keys as applicable before registering transactions.
Before registeringtransactions 1234 Submit trusted IPsFor the allowlist Access grantedRestoration is phased Reset passwordsRotate API keysas applicable Then register transactions After the required changes
Reactor, Investigations API and Rapid Lookup remain under maintenance in the captured Nov. 7 status.
An operational screening label does not mean every customer is ready to register transactions.
Status is time-bound to the captured November 7 updates. Customer counts, completion percentages and an investigation-service restoration deadline are not supplied. A required action in the diagram is not a claim that every customer has completed it.
KYT monitors transactions, Address Screening assesses wallet risk exposure, and Reactor helps investigators trace funds across blockchains. Reactor has since returned, while the Investigations API and Rapid Lookup outages continue.
What customers need before resuming screening
In its Nov. 6 restoration instructions, Chainalysis asked customers who had not already done so to submit trusted IP addresses for its allowlist through their account team or support contact.
Those instructions required users to reset passwords and rotate applicable API keys after access was granted and before registering transactions.
Chainalysis said it was validating enhanced security controls during the phased restoration. The later Nov. 7 announcement confirmed Reactor had returned alongside KYT and Address Screening.
The recovery follows disclosures that went beyond the initial identity-data exposure covered by CryptoSlate on Oct. 31. The original Oct. 30 notice listed accessed user IDs, names, email addresses and organization role labels.
In a Nov. 4 update at 11 p.m. EST, Chainalysis said it had discovered on Nov. 2 that names, usernames, password hashes and live login tokens for all users had been exposed to a malicious actor. Password hashes are encoded password records; live tokens can keep a user signed in. That disclosure does not establish that every account was accessed.
The company also said abnormal activity on Nov. 4 prompted it to take KYT, other address-screening products and the login page offline. It was notifying customers whose KYT accounts appeared to have been accessed without authorization.
In that Nov. 4 update, Chainalysis continued to say it had no evidence investigation data had been accessed or attribution data manipulated. Its investigation was ongoing.
