Chainalysis breach exposes user data after attack with 'agentic' techniques

Who is affected

Chainalysis says all users of its platform had some information exposed in the breach. Its customers include over 1,500 organisations, such as law enforcement agencies, financial institutions, regulators and companies in the cryptocurrency sector. The company has not said how many individuals or organisations were affected, nor has it specified whether every type of data was exposed for every user.

What was taken

According to Recorded Future News↗ (opens in a new tab), the attackers accessed certain customer information, including names, usernames, password hashes and live tokens for all users. Password hashes are scrambled versions of passwords, but some types can be cracked. Live tokens can allow access to accounts without a password, depending on how they are used. Chainalysis has not explained what it meant by 'live tokens' or how the passwords were hashed. Some customer accounts on the Know Your Transaction (KYT) service were also reportedly accessed. The company says there is no evidence that investigation data or attribution data was accessed or manipulated.

How the attack worked

Chainalysis says the attackers used "offensive agentic techniques" to gain access to its systems and internal tools. The company has not explained what this means, but the term suggests the use of automated or AI-driven methods that can act independently. The initial breach was disclosed on 30 October. Later, the company said that some customers' passwords had been exposed in an "on-path attack", a method where an attacker intercepts communications between a user and a service. It is unclear whether the password interception, exposure of hashes and tokens, and suspected account access all involved the same attacker or method.

The response

Chainalysis has brought in third-party cybersecurity experts to investigate and strengthen its defences. All users are being required to reset their passwords and rotate API keys. The company has advised customers to visit its login page directly, rather than clicking links in password reset emails, to avoid phishing attempts. Some products, including Reactor and Data Solutions, were taken offline as a precaution. The company planned to begin restoring some services after customers submitted trusted IP addresses to be allowlisted. Chainalysis has not given a date for restoring all affected products.

What you should do

Chainalysis is urging customers to enable two-factor authentication (2FA) if they have not already, and to be alert for unexpected password reset requests or authentication prompts. Customers should follow their organisation’s security protocols and report any suspicious activity to their IT or security teams. The company also recommends not following links in emails, but instead navigating directly to its site for any account actions.

No primary source from Chainalysis or an official agency has been published yet. The company has not explained what "offensive agentic techniques" means, nor how many users were affected or exactly what data was accessed for each user. It is also unclear whether all incidents described are linked to the same attacker or method.