Chainalysis took Reactor and Data Solutions offline during security investigation

Chainalysis took two products offline during a security investigation.

Chainalysis said on November 2 that it had taken some products offline, including Reactor and Data Solutions, while security experts carried out additional assessments. The update followed an October 30 disclosure of unauthorized access. The company’s notice to affected customers described an external actor using agentic attack techniques to gain access to Chainalysis systems and internal tools. Compliance transaction monitoring products continued operating under closer monitoring at the time of the update. [Chainalysis incident notice and November 2 update](https://www.chainalysis.com/blog/security-incident-october-30/)

Which data the company says was accessed

Chainalysis reported access to some customer account information, including names, email addresses, user IDs and organization role labels. It said it was determining the records affected for individual organizations. The company reported finding no indication at that stage of unauthorized access to investigation material such as graphs and case notes, transaction or query results, clear-text passwords, multifactor authentication secrets or session tokens. That assessment reflects the evidence available when it published the notice. [Chainalysis incident notice](https://www.chainalysis.com/blog/security-incident-october-30/)

Role labels and contact information can help an impersonator work out whom to target. They can also make a false message about a permissions change or case assignment appear credible. Chainalysis asked customers to follow their established security procedures and report suspicious activity. Its notice treats this incident separately from the crypto theft at Binance that its research teams have covered. [Chainalysis incident notice](https://www.chainalysis.com/blog/security-incident-october-30/)

Why availability varied across products

The company described the outages as a precaution while it investigated. It said it kept transaction monitoring available because customers rely on those tools to support compliance and detect money laundering. In an incident, taking a product offline may limit further exposure while creating a separate operational problem for the people who use it. Keeping another service online requires enough confidence in the evidence and monitoring to justify the decision.

The published notice gives customers three different facts to track. Some account data was accessed, certain products were paused and the company was still investigating. A restoration announcement and a final account of impact would answer different questions. Neither follows from the November 2 status alone. [Chainalysis November 2 update](https://www.chainalysis.com/blog/security-incident-october-30/)