A Compliance Vendor Was Breached, and the First Notice Understated It: Chainalysis Exposes All User Credentials

On October 30, blockchain analytics and compliance provider Chainalysis disclosed that an external attacker had accessed its internal systems. At the time it said only data such as user IDs, names, emails and role labels was involved, with no evidence that passwords or session tokens were accessed, and it advised customers to enable two-factor authentication. On November 2, Reactor and Data Solutions were taken offline as a precaution.

On November 4 the company issued a series of updates. An on-path attack had exposed a subset of customer passwords, and affected accounts were locked. After further abnormal activity, KYT transaction monitoring (UI and API), other address screening products and the login page were taken offline. Late that night it confirmed that names, usernames, password hashes and live tokens for all users had been exposed. Every user must first send trusted IP addresses to support for allowlisting, then reset passwords and rotate API keys as appropriate. The company says it has seen no evidence that investigations data was accessed or attribution data altered. The initial point of entry has not been disclosed.

Where small teams are exposed

Five things you can do now

• List the compliance, risk and data vendors your team relies on, with the accounts, API keys and internal systems tied to each one
• For the affected service: reset passwords through the official site, rotate API keys and restrict calls to known IPs. Change the same password anywhere else it was reused
• Do not click links in "reset your password" emails. Incidents like this are often followed by phishing that imitates vendor notices
• Write a fallback plan for when screening is unavailable: which transactions go to a manual review queue, who approves them, and when to escalate
• After a vendor publishes an incident notice, assign one person to follow its updates and reassess whenever the scope grows

The timeline, scope of exposed data, services taken offline and required customer actions come from Chainalysis's official incident notice (updates through Nov 4, 2026, 11:00 PM EST). The company says a subset of customer passwords was exposed through an on-path attack and does not say whether they were in plaintext. The point of entry and the attacker have not been disclosed. This article does not cover attack details.