Chainalysis has disclosed a security incident in which attackers used what the company calls "offensive agentic techniques" to gain unauthorized access to its internal systems and tools. The blockchain intelligence firm said some customer information was accessed, including names, email addresses, user IDs and organizational role labels. Chainalysis said it has found no evidence that sensitive investigation data or authentication credentials were exposed.
The company, whose blockchain analytics tools are used by law enforcement, government agencies, cryptocurrency exchanges and financial institutions to trace transactions and investigate fraud, ransomware and money laundering, published the incident disclosure and the full text of the email sent to affected customers on Friday at roughly 5:14 PM ET. The disclosure states that Chainalysis detected an external actor using the techniques earlier this month and has since been patching vulnerabilities and hardening its systems. The company is still determining which records were accessed for each organization and will provide a detailed breakdown once that analysis is complete.
A Chainalysis spokesperson confirmed the incident and said the company is working with external cybersecurity experts. Chainalysis is also using large language models to support a broader security review of its platform. According to the company, the investigation to date has found no unauthorized access to investigation content, authentication credentials or session tokens, and the incident is unrelated to the recent Binance theft.
Chainalysis has not shared technical details about the intrusion, including which vulnerabilities were exploited, which internal tools were accessed, or how long the attackers had access. It is unclear whether the attackers used existing agentic offensive security frameworks such as ARTEX, which Microsoft says has recently been used by threat actors including in the ConnectWise supply chain compromise, or custom-built AI agents capable of autonomously identifying vulnerabilities, exploiting them and chaining together subsequent actions. The term "agentic" generally describes AI systems capable of executing multi-step tasks with limited human intervention.
Customers are advised to enable two-factor authentication and to watch for unexpected password reset requests, authentication prompts and scammers impersonating Chainalysis, particularly those offering fund recovery or recruiting services. Chainalysis said it will share further updates with affected customers as its investigation progresses.
The disclosure comes during a week of security incidents affecting the cryptocurrency and technology industries. Binance linked the roughly $6.3 billion theft, now the largest crypto heist on record and attributed to North Korean state-backed hackers, to a compromised DevOps engineer's laptop. Hardware wallet maker Trezor warned of a suspected cryptocurrency-stealing implant reported in a Trezor Safe 5 device sold by a Southeast Asian reseller, which can reportedly read the recovery phrase shown on the device's screen and transmit it over a mobile network. Separately, a malicious version of Anthropic's official Claude Code extension was distributed through the Cursor extension marketplace, planting persistent SSH backdoors on developers' machines.
More cybersecurity news from TechManNews.
