Chainalysis roundup: Security recovery and AI payments
Blockchain intelligence company Chainalysis reported two developments on November 10, 2026, covering the recovery of its cryptocurrency compliance infrastructure and the use of stablecoins in China’s market for restricted artificial intelligence services. In today’s crypto security roundup, Chainalysis confirmed that Data Solutions had returned online following a customer-credential exposure incident, completing the announced restoration of its principal investigation and screening products. Separately, new research found that 40% of surveyed AI proxy services accept cryptocurrency, with custodial payment processors helping connect customers to operators offering access to restricted American AI models.
Chainalysis restores Data Solutions after security incident
Chainalysis confirmed at 03:00 Eastern Standard Time (08:00 UTC) on November 10 that its Data Solutions product was back online following a security incident that had disrupted several of its core blockchain intelligence services.
The restoration followed the November 7 reopening of Reactor, Know Your Transaction (KYT) and Address Screening. Those products had returned online at 13:50 EST (18:50 UTC), with the company introducing enhanced security measures and requiring customers to follow specific reconnection procedures.
Data Solutions remained unavailable for an additonal three days while the company completed further security work.
Chainalysis said it was restoring customer access as quickly as possible and had emailed affected organizations with instructions. Its announcement confirmed that the product was operational, but did not establish that every customer had immediately regained access.
The service was back, though the customer-by-customer work was still going.
The company previously instructed customers to submit trusted IP addresses for allowlisting, reset account passwords and rotate application programming interface (API) keys where applicable. These measures formed part of its phased restoration process, which began with KYT and Address Screening on November 6.
Chainalysis has not disclosed how many customers remain subject to account-specific reconnection procedures or whether all integrations that depend on its products have been fully restored.
Credential exposure investigation remains unresolved
The recovery follows a security incident first disclosed on October 30, when Chainalysis reported unauthorized access to internal systems involving an external attacker using what it described as offensive agentic techniques.
The company’s initial investigation found no indication that investigation content, clear-text passwords, authentication secrets or session tokens had been accessed. Subsequent findings expanded the confirmed exposure.
On November 4, Chainalysis disclosed that customer information, including names, usernames, password hashes and live tokens, had been exposed to a malicious actor. The company described the affected records as relating to all Chainalysis users.
It separately confirmed that an on-path attack had exposed passwords belonging to a subset of customers. Chainalysis said that attack vector had been contained and remediated, and began locking affected accounts pending password resets.
As previously covered in DaveFinances’ report on the Chainalysis security incident, the company subsequently detected abnormal activity affecting its transaction-monitoring systems.
On November 4, it took KYT, its API, other address-screening products and the login page offline. Reactor and Data Solutions had already been suspended as part of the investigation.
The company also said it was directly notifying customers whose KYT accounts appeared to have been accessed without authorization.
It was a security reset as well, not simply switching the products on again.
Chainalysis maintained that its investigation had found no evidence that investigation data had been accessed or its blockchain-attribution data manipulated. Its November 10 recovery announcement did not provide a final assessment of the credential exposure or identify the total number of accounts improperly accessed.
The interruption also overlapped with service problems involving external cryptocurrency-screening providers at several Japanese exchanges.
Coincheck, for example, restored cryptocurrency withdrawals after an 80-hour interruption involving an unidentified external analytics provider. Chainalysis had begun restoring its screening services before Coincheck announced its recovery, but neither company established that the two incidents were connected.
There is a gap in the record here, and it is not a small one.
Chainalysis has confirmed the restoration of its main products, but the final scope of unauthorized account access and the extent of any disruption experienced by downstream customers remain undisclosed.
Chainalysis finds crypto payments at 40% of AI proxy services
In a seperate November 10 development, Chainalysis published research examining how cryptocurrency supports a market for proxy services that provide indirect access to advanced American artificial intelligence models.
The company’s Global Intelligence Team surveyed 100 AI proxy services and found that 40 accepted cryptocurrency payments, predominantly through stablecoins.
These services act as intermediaries between customers and AI models they cannot access directly. Operators obtain access to systems such as Claude, ChatGPT and Gemini, then resell that access through subscriptions, prepaid credits or usage-based arrangements.
Chainalysis said the services can conceal the origin of user requests, potentially enabling customers in restricted markets to obtain access despite geographic or contractual limitations imposed by AI providers.
Customers can also pay through conventional methods, including Chinese payment platforms such as WeChat Pay and Alipay. Cryptocurrency provides an alternative route for customers seeking to avoid domestic payment channels.
Forty out of a hundred services, and stablecoins were the main crypto option.
The research comes amid continuing US restrictions on the export of advanced computing technology. The Department of Commerce’s Bureau of Industry and Security outlined potential licensing requirements in its May 2025 guidance on advanced computing and AI training, including certain activities involving restricted computing equipment and end users in China.
Those requirements concern specific controlled technologies, transactions and end uses. Accessing an AI model through an intermediary or paying for it with cryptocurrency does not, by itself, establish an export-control violation.
Chainalysis also examined cryptocurrency payments from wallets it assessed as potentially linked to Chinese users. Its researchers found that activity increased above normal levels in the days following major US frontier-model releases, relative to the wider set of wallets paying these services.
The pattern is consistent with increased demand for newly released AI capabilities, including possible efforts to obtain model outputs for distillation, a technique that uses responses from one AI system to improve another.
The payments rose after some model releases, but why exactly, the data cannot settle.
Chainalysis acknowledged that the aggregate transaction data could not establish the cause of the increases. The research also did not provide a verified total value of transactions associated with illegal access, identify every payment’s ultimate purpose or demonstrate that the observed activity represented model distillation.
Custodial processors complicate crypto payment tracing
The research identified a payment structure in which many AI proxy services use custodial cryptocurrency payment processors rather than receiving digital assets directly from customers.
Under this arrangement, a customer transfers cryptocurrency to an intermediary, which handles payment processing and may subsequently settle funds with the proxy operator.
Chainalysis found wallets associated with the proxy-payment ecosystem across China, Japan, Hong Kong, Singapore and South Korea. It interpreted the regional distribution as consistent with proxy access routes serving Chinese customers, although wallet attribution cannot establish every individual user’s identity or physical location.
The involvement of payment intermediaries creates a visibility problem for regulated exchanges and compliance teams. A transfer originating from an exchange may terminate at a custodial processor without directly identifying the merchant or service receiving the economic benefit.
The money trail is there, but the customer behind it, less clear.
This structure resembles issues examined in DaveFinances’ earlier analysis of payment intermediaries and sanctions exposure, where distinguishing a direct counterparty from an indirect relationship is essential to evaluating potential legal and compliance obligations.
In the AI proxy market, Chainalysis suggested that custodial processors could help operators maintain access to cryptocurrency payments while reducing their direct exposure to domestic financial restrictions.
The research did not identify a comprehensive list of processors involved, establish which operators were knowingly facilitating prohibited activity or show that all cryptocurrency payments to AI proxy services were unlawful.
It also did not quantify how much of the surveyed market’s revenue came from cryptocurrency compared with conventional payment methods. The 40% figure measures the proportion of surveyed services offering crypto payments, not cryptocurrency’s share of their actual sales.
For exchanges and payment providers, the more specific compliance issue concerns merchant identification and the visiblity of transactions passing through custodial intermediaries. The research provides evidence of these payment arrangements but leaves the underlying transaction values, individual counterparties and legal status of particular payments unresolved.
Chainalysis’ two November 10 disclosures concern different aspects of its business. Its security update documents the restoration of critical blockchain intelligence products following credential exposure, while its research examines financial infrastructure that may be used to obtain restricted AI services.
The first leaves questions about the completed account recovery and investigation. The second identifies a growing payment channel but does not establish its total size or the proportion associated with unlawful conduct. Both developments leave important details unconfirmed, despite the restoration announcement and the new research findings.
Johan Shamshad is Editor-in-Chief at Dave Finances, covering financial markets, digital assets, trading platforms, brokers, fintech, payments and regulation. Since 2023, he has also worked as an editor at Gulf News, the UAE English-language newspaper published by Al Nisr Publishing LLC. His work focuses on market-moving developments, company disclosures, regulatory changes and trading infrastructure, with an emphasis on primary-source verification and practical context for traders and investors.