Chainalysis says an attacker used “offensive agentic techniques” to gain access to its systems and internal tools, exposing customer profile information. The blockchain analytics company’s October 30 disclosure says the intrusion was detected during October and that it is still determining which records were accessed for each organization.
The exposed fields include user IDs, full names, email addresses and organizational role labels for people provisioned on its platform. Chainalysis described the information as non-sensitive customer data. It has notified all customers and said affected organizations will receive a detailed breakdown when its analysis is complete. Some customers had already been notified before the October 30 update.
The company reports no indication, based on evidence available so far, that the intruder accessed investigation graphs, notes or cases, transaction or query results, cleartext passwords, multi-factor authentication secrets or user session tokens. It also says the incident is unrelated to the cryptocurrency theft at Binance.
Chainalysis has not explained which vulnerabilities were exploited, how long the intruder remained inside or what the agentic tools did. The disclosure does not establish that an autonomous system conducted the entire intrusion without a human operator. A company spokesperson confirmed the incident to BleepingComputer.
Engineers have been patching vulnerabilities and hardening systems, while outside cybersecurity specialists investigate. Chainalysis says it is also using large language models to support a broader security review that extends beyond the vulnerabilities exploited in the breach.
Banks, crypto exchanges and public-sector investigators use Chainalysis software to follow blockchain transactions, including inquiries into money laundering and ransomware payments. Its own use of agents predates this incident: chief executive Jonathan Levin introduced blockchain intelligence agents at the company’s Links conference in March.
The company described those agents as tools for investigators and compliance teams, with deterministic workflows for critical decisions and an exploratory mode for other work. It said both modes would produce audit trails, and that people would decide which tasks could be automated and how independently an agent could operate.
Other recent disclosures have involved agents accessing live data under different circumstances. India’s CERT-In said agents undergoing research and evaluation reached real organizations’ systems through exposed credentials and excessive permissions. Separately, US banks have restricted third-party agents using customers’ credentials; Morgan Stanley said it had not observed rogue agents accessing its platforms.
Chainalysis advises users to enable two-factor authentication and be alert to unexpected password-reset requests or authentication prompts. It says it will continue providing affected organizations with updates as the investigation progresses.
Sources: Chainalysis, BleepingComputer, Chainalysis
–
By the Control Plane Editorial Team