What the company disclosed
In its 4 November, 11 p.m. EST update, Chainalysis said a malicious actor had obtained names, usernames, password hashes and live tokens for all users. This expanded the scope of its earlier public description. The company said it had no evidence at that point of accessed investigations data or manipulated attribution data.
What changed on 6 November
Chainalysis reported that KYT and Address Screening were returning in phases. It asked customers to submit trusted IP addresses through their account team or official support channel. Users regaining access would need to reset passwords and rotate API keys where applicable. Recovery of other products remained in progress.
Practical takeaway — Falak83 analysis
Open the known Chainalysis website directly. Follow its recovery instructions, replace reused passwords elsewhere and review connected integrations. Ask your administrator to check available multi-factor authentication and unusual access. Do not treat a password reset alone as a replacement for token and API-key recovery.
Important distinction
The credential disclosure was dated 4 November. The 6 November update concerned recovery; it did not mean every service was fully restored.
Sources and date
Prepared for 7 November 2026. Source date: 4 and 6 November 2026.
Prepared with AI assistance. Publication requires human editorial approval.
