Chainalysis says attacker using agentic AI techniques accessed customer names and emails

Chainalysis, the U.S. blockchain analytics firm that traces stolen crypto, said an outside attacker broke into its own systems and viewed names and email addresses of users at its customer organizations. In a "Security Incident Information" post on its official blog at 6:14 a.m. KST on Oct. 31, the company said it detected an external actor this month using "offensive agentic techniques" to gain unauthorized access to Chainalysis systems and internal tools.

Names and emails exposed, investigation data intact

According to the full text of an email Chainalysis sent to customers, the data accessed comprised user IDs, full names, email addresses and organization role labels for users provisioned on its platform. The company called it "non-sensitive customer data." It said it had found no indication of unauthorized access to investigation content such as graphs, notes or cases, transaction or query results, passwords in clear text, MFA secrets or user session tokens.

Chainalysis has not disclosed how many users or organizations were affected. It said it is determining which records were accessed for each organization and will provide a detailed breakdown once that analysis is complete. The company said some customers had been notified earlier and that the email was an update on its work. At the top of the notice, it described the incident as similar to those at many other tech platforms in recent weeks.

AI-powered intrusion, AI-assisted security review

Chainalysis did not describe the attack method in detail. Agentic AI refers to systems that carry out multistep tasks on their own without a human directing each step. "We are seeing an industry-wide rise in AI-driven cyberattacks," the company said in the email.

Its response also leans on AI. Chainalysis said it has engaged outside cybersecurity experts and is using sophisticated large language models (LLMs) to support a broader review of security across its platform, beyond the vulnerabilities that were exploited. It said it is patching those vulnerabilities.

In the middle of the Binance hack investigation

The disclosure came shortly after about $6.4 billion was drained from Binance hot wallets, the internet-connected wallets used for withdrawals. Chainalysis stated twice that the security incident is not related to the Binance theft.

Chainalysis has played a key role in tracing funds stolen in the Binance hack. In an Oct. 30 blog post, it said funds began leaving Binance around 4:20 p.m. ET on Oct. 29 and attributed the theft to TraderTraitor, a North Korean hacking group. It cited on-chain evidence that Binance funds were commingled with funds stolen from Bitget last month. The Bitget theft was also attributed to North Korean actors. Chainalysis announced the attribution at 12:30 a.m. ET on Oct. 30 (1:30 p.m. KST).

Chainalysis said it is sharing investigative leads with industry partners to help identify and freeze funds. Freezes began around 5:14 p.m. ET on Oct. 29, and about $2.8 billion had been frozen, by its count. It said it expects the stolen funds to keep moving in the coming days and will update its address labels.

On its company page, Chainalysis says it provides data to government agencies, exchanges, financial institutions and cybersecurity companies in more than 70 countries and has over 1,500 customers. Its products include KYT (Know Your Transaction), which exchanges use to screen the risk of deposit addresses. The company was founded in 2014. In April 2020, Chainalysis announced an expanded partnership with Upbit under which Upbit APAC exchanges in markets including Singapore and Indonesia would also use KYT. The notice does not say which countries or customers were affected.