.png)
A Breach Doesn't End When Services Come Back Online
Chainalysis restored several major services after a security incident exposed credentials and tokens belonging to its users. Its recovery process shows why incident response requires more than resetting passwords.
ITSEC Asia.png)
On 7 November 2026, Chainalysis announced that its Reactor platform, KYT transaction-monitoring interface and API, and Address Screening products were back online after a security incident. The company said the services had been restored with enhanced security measures and asked customers to reconnect through a specific process. [1]
Chainalysis first disclosed the incident on 30 October. It said an external actor had used what it described as “offensive agentic techniques” to access its systems and internal tools without authorisation. Its initial notice reported access to user IDs, names, email addresses and organisational role labels, but said there was no evidence at that stage that investigation content, authentication credentials or session tokens had been accessed. [1]
The assessment changed as the investigation progressed. In an update on 4 November, Chainalysis said names, usernames, password hashes and “live tokens” for all users had been exposed. It separately confirmed that an on-path attack exposed passwords belonging to a subset of customers. The company said that attack path had been contained and remediated. It continued to report no evidence that investigation data had been accessed or its attribution data manipulated. Customers whose KYT accounts appeared to have been accessed without authorisation were being contacted directly. [1]
The public update doesn't specify what types of tokens were exposed. That distinction matters: a session token, API key and service credential can grant different permissions and require different containment steps. It would be inaccurate to assume they were all the same.
On 6 November, Chainalysis asked customers to submit trusted IP addresses for allowlisting and prepare to reset passwords and rotate API keys where applicable. The 7 November update confirmed that Reactor, KYT and Address Screening were back online. It didn't say that every product previously taken offline had been restored. [1]
The case shows why incident response continues after an attacker's access path has been contained. Teams must establish what was exposed, invalidate credentials that may remain usable, restore services safely and help customers avoid follow-on phishing.
A password reset is only one part of that work. OWASP's Secrets Management guidance says potentially compromised secrets should be revoked and replaced. Restarting an application doesn't itself invalidate a stolen credential; it may remain usable until the underlying service expires or revokes it. [2] Organisations therefore need an inventory of API keys, service credentials, tokens and the systems that depend on them.
For incident responders, the practical work includes:
-
Mapping exposed identities and secrets to the applications, APIs and data they can reach.
-
Revoking active sessions and compromised tokens, then rotating affected passwords, API keys and service credentials.
-
Reviewing authentication logs and API activity for suspicious use.
-
Restoring services in stages and giving users clear instructions.
-
Preserving evidence and recording which credentials were revoked, replaced and tested.
Chainalysis advised customers to visit its normal login page directly rather than follow links in unexpected password-reset emails. A breach can create the perfect conditions for impersonation attempts. [1]
NIST's incident-response guidance treats response and recovery as part of wider cybersecurity risk management, not a task that begins and ends with the security team. [3] A credential incident can involve SOC analysts, identity administrators, application engineers, cloud teams, customer support and communications staff. They need a shared picture of what's known, what remains uncertain and which actions come first.
These are skills built through practice. ITSEC Cyber & AI Academy develops cybersecurity and AI capabilities through practical learning and professional development. Exercises involving credential exposure, token revocation, service restoration and customer communication can help learners understand how incident response works across technical and business teams.
Explore cybersecurity and AI learning opportunities at https://www.itsec.academy/.
References
-
Chainalysis, Updated Nov 7: Chainalysis Security Incident Information, initially published 30 October 2026, updated 7 November 2026. https://www.chainalysis.com/blog/security-incident-october-30/
-
OWASP Foundation, Secrets Management Cheat Sheet, accessed 9 November 2026. https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet
-
National Institute of Standards and Technology (NIST), Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile, NIST SP 800-61 Rev. 3, 3 April 2025. https://doi.org/10.6028/NIST.SP.800-61r3
