---
title: "Chainalysis Starts Reopening Compliance Tools Behind IP Allowlists in Sixth Breach Update"
url: https://thecoingazette.com/chainalysis-starts-reopening-compliance-tools-behind-ip-allowlists-in-sixth-breach-update/
date: 2026-11-06
modified: 2026-11-06
lang: en
author: "Coin Gazette Editorial"
description: "Customers that haven't sent trusted IP addresses must do so first, and every user must then set a new password; the firm said late Wednesday all users' password hashes were exposed. The post Chainalysis Starts Reopening Compliance Tools Behind IP Allowlists in Sixth Breach Update appeared first on Unchained."
categories:
  - "Crypto News"
tags:
  - "crypto"
  - "cryptocurrencies"
  - "Defi"
  - "Market Trends"
  - "News"
word_count: 415
---

# Chainalysis Starts Reopening Compliance Tools Behind IP Allowlists in Sixth Breach Update

Chainalysis started restoring access to its KYT (Know Your Transaction) monitoring and Address Screening tools on Friday, one group of customers at a time, after the blockchain analytics firm disclosed late Wednesday that password hashes and live tokens “for all Chainalysis users” had been exposed to an attacker.
Customers that haven’t yet sent the trusted IP addresses they want allowlisted must do that first, the company said in a 3:30 a.m. ET update. Once access is granted, every user has to reset their password, and rotate API keys where applicable, before registering transactions. More customers will be let in as each phase checks out. Reactor, its investigations software, and Data Solutions, its threat-intelligence product, stay offline; the company said external security experts are helping it harden its systems before those two return.
Chainalysis has not given a user count or said how many KYT accounts were accessed without authorization. The post does not define “live tokens,” and it gives no date for Reactor and Data Solutions to come back.
The Oct. 30 email Chainalysis published had put user IDs and email addresses in the category of “non-sensitive customer data.” Unchained reported on Nov. 2 that the company had then seen no sign of session tokens, clear-text passwords or multi-factor authentication (MFA) secrets being reached. Chainalysis’s Wednesday-night entry reported “no evidence that any investigations data has been accessed or Chainalysis attribution data has been manipulated.”

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

Six Entries Since Oct. 30
Chainalysis’s incident post now carries six dated entries, by Unchained’s count. All times are ET.

Oct. 30: The first public post, with the email sent to customers about an outside intrusion into internal systems and tools.
Nov. 2: Reactor and Data Solutions pulled as a precaution, with transaction monitoring kept running.
Nov. 4, 9:50 a.m.: An email to certain customers whose Chainalysis passwords leaked in an “on-path attack,” locking their accounts until a reset.
Nov. 4, 10:30 a.m.: KYT’s interface and API, other address-screening products and the login page taken down after abnormal activity.
Nov. 4, 11 p.m.: The all-users exposure, found that Monday, plus word that the company was contacting KYT customers whose accounts showed signs of unauthorized access.
Nov. 6, 3:30 a.m.: Phased restoration of KYT and Address Screening begins.

Related Listen: Ransomware Now Runs Without Humans. Is It Time to Hack Back?

The post Chainalysis Starts Reopening Compliance Tools Behind IP Allowlists in Sixth Breach Update appeared first on Unchained.