Chainalysis breach: what changed between the Oct. 30 statement and Nov. 4 warning

Chainalysis told customers on Oct. 30 that a malicious actor had accessed customer profile information, and that its initial assessment found no evidence authentication credentials or session tokens had been compromised. Five days later, on Nov. 4, the company said password hashes and live tokens belonging to all of its users had been exposed, and that some customer accounts appear to have been accessed without authorization.

Chainalysis has not said what changed its assessment, what the attack vector was, or who was behind it. It has not given a number for how many accounts were actually accessed, as distinct from exposed. It has not said whether the live tokens were used against customer accounts or data before rotation.

The operational impact is documented. Chainalysis took KYT, Reactor, Data Solutions and Address Screening offline after detecting suspicious activity. On Nov. 6, it began gradually restoring KYT and Address Screening. Reactor and Data Solutions had not been restored as of that step. Customers are required to reset passwords and rotate API keys where applicable, and the company is working to restore access through approved IP addresses.

Chainalysis serves more than 1,500 customer organisations across cryptocurrency businesses, financial institutions and law enforcement. Those customers use its tools to check whether money is tied to theft, sanctions or laundering. Exposure of live tokens and password hashes at that kind of firm creates follow-on risk: credential reuse, API-key abuse, and disruption to compliance and investigation workflows while services remain under maintenance.

A firm whose product is trust in crypto data is now asking customers to trust its account of how the breach unfolded. The Nov. 4 statement is the current one, and it is the one customers are acting on.