Chainalysis: all users' live tokens, Reactor down

Chainalysis widened its account of the agentic intrusion on November 6, 2026. The blockchain analytics firm now says the same investigation reached names, usernames, password hashes, and live tokens for every user. While that review continues, Chainalysis has pulled Reactor and Data Solutions offline. It has also taken down the Know Your Transaction interface and API, other address-screening products, and the login page.

The October 31 customer letter described a narrower loss: user IDs, full names, email addresses, and role labels, with investigation content, credentials, and session tokens still inside the company. The November update replaces that credential line. Chainalysis also says an on-path attack exposed passwords for a subset of customers, and that it has since closed that path. Impacted accounts are locked. The company says the review still shows investigation files unread and its attribution data unaltered.

Chainalysis has stood up extra monitoring for unusual activity. It has not named the operator. It describes the intrusion as resembling attacks reported at other technology platforms in recent weeks. The exposed set is every provisioned user at the exchanges, law-enforcement agencies, and financial institutions that buy Chainalysis tracing and screening. A live token can still authenticate as that user until someone rotates it. A password hash can be tested anywhere the same password was reused.

The reset email cannot be completed yet

Some customers have already received mail telling them to reset the Chainalysis password. Chainalysis says that reset will fail while the login page is down. The instruction that still applies today is the one aimed at every other system: if the Chainalysis password was reused, change it there now. A lock on the vendor account does not retire a password that also opens mail, a VPN, or another console.

Restoration, as Chainalysis describes it, starts with KYT and address screening. Customers are asked to send trusted IP addresses to [email protected] or to their account team so those addresses can be placed on an allowlist. After that, users reset passwords and rotate API keys before they register transactions again. Reactor and Data Solutions stay down while the company hardens them. Chainalysis says every user will have to reset passwords and rotate API keys, and that it will send those requirements as the services return.

What to do while the products are dark

Treat every provisioned user as exposed. The company said “all users,” so a tenant that is waiting for a per-seat appendix should not wait to act. Reset reused passwords on mail, identity providers, and any other admin console today. Store the new secrets in a manager the Chainalysis account does not unlock.

Inventory API keys that talk to KYT, address screening, or Reactor. Plan the rotation for the hour access returns, and pause automated jobs that will hammer a dead login in the meantime. Send the allowlist from a channel you already trust. The addresses should be the ones your analysts and integrations actually use, not a wide corporate range that recreates the open door.

Warn staff that a recovery pitch, a recruiting note, or a password-reset page invoking Chainalysis is hostile until someone inside the organization places the call. Role labels and email addresses left in the earlier disclosure. Hashes and live tokens joined them in this one. An impersonator now has both a name and a reason to sound urgent.

When the allowlist opens, reset the Chainalysis password, rotate every API key, and confirm the old tokens no longer authenticate. File the company’s written claim that investigation files stayed unread and attribution data stayed unchanged, and ask for the per-organization record list when Chainalysis finishes the count. A token that has already been read has to be expired. A password that left as a hash has to be retired everywhere else it was typed.

This briefing relies on public reporting by The Hacker News and on Chainalysis’s customer updates.