Chainalysis says an attacker used “offensive agentic techniques” to access customer data

What the company said

Blockchain analytics firm Chainalysis disclosed a security incident on its blog on the evening of Oct. 30, at about 5:14 p.m. ET. It also published the full text of the email it sent to affected customers. According to BleepingComputer, Chainalysis tools are used by law enforcement, government agencies, crypto exchanges and financial institutions to trace transactions and investigate fraud, ransomware and money laundering.

According to the email, Chainalysis detected an external actor this month using “offensive agentic techniques” to gain unauthorized access to its systems and internal tools. The “agentic” label is the company’s own, and it gave no exact detection date. Chainalysis said its teams have been working around the clock to investigate the activity, patch vulnerabilities and harden its systems. The email also says some customers had been notified earlier.

The data that was accessed

The company says some non-sensitive customer data was accessed, such as user IDs, full names, email addresses and organization role labels for users provisioned on its platform. Chainalysis is still determining which records were accessed for each organization and will share a detailed breakdown once that analysis is complete. It says it found no indication of access to investigation content (graphs, notes or cases), transaction or query results, clear-text passwords, MFA secrets or user session tokens.

Chainalysis said it is working with outside cybersecurity experts and using large language models to support a broader review of its platform’s security. It advised users to watch for unexpected password reset requests and authentication prompts and to enable two-factor authentication. According to BleepingComputer, customers were also warned about scammers impersonating Chainalysis, particularly those offering fund recovery or recruiting services.

What remains undisclosed

Chainalysis stressed that the incident is unrelated to the recent crypto theft at Binance, and said the industry is seeing a rise in AI-driven cyberattacks. The disclosure came during a busy week. As BleepingComputer noted, Binance linked the roughly $6.3 billion theft, the largest crypto heist on record, to a compromised DevOps engineer’s laptop. A malicious version of the Claude Code extension had also been distributed through Cursor’s extension marketplace that week.

The company has not said which vulnerabilities were exploited, which internal tools were accessed or how long the attacker had access. It also hasn’t disclosed how many people were affected or who the attacker is. According to BleepingComputer, it is unclear whether the attackers used an existing agentic offensive framework such as ARTEX or custom AI agents that can find and chain exploits on their own. Citing Microsoft, the outlet noted that ARTEX was recently used in the ConnectWise supply chain compromise. The Hacker News wrote that the wording indicates an AI-powered tool was used; that is the outlet’s own reading.

The Nov. 2 update

Chainalysis added an update to the notice on Nov. 2, saying it continues to respond to ongoing cyber threats associated with the incident. As a precaution, it took certain products offline, including the Reactor investigations tool and Data Solutions, its threat intelligence product. They will stay offline while third-party experts complete additional security assessments. Its compliance transaction monitoring products remain running because of their role in detecting money laundering. The company says it is closely monitoring those systems for unusual activity.