Blockchain-tracing firm Chainalysis says every user's data was exposed in a breach
The company that helps police and banks trace crypto says an attacker using "agentic techniques" got names, password hashes and live login tokens for all users.
What happened: Chainalysis, the blockchain analytics firm whose software helps trace cryptocurrency transactions, confirmed that every one of its users had some personal data exposed in a cyberattack it first disclosed on October 30. In its latest update, the company said names, usernames, password hashes and active login tokens were exposed for all users, and that some accounts on its transaction-monitoring tool, Know Your Transaction, appear to have been accessed. It has not identified the attacker, has not said how many users are affected, and has not fully explained what it means by "offensive agentic techniques," the phrase it used to describe part of the intrusion.
Why it matters: Chainalysis says it serves more than 1,500 organizations, including police, intelligence and financial-crime units that rely on its tools to track illicit crypto flows. A breach touching that client base is a safety issue beyond a typical data leak: investigators' own logins, and potentially the trustworthiness of the data they build cases on, are now in question, even though Chainalysis says it has no evidence its investigations data or attribution findings were altered. The company itself has framed the incident as part of "an industry-wide rise in AI-driven cyberattacks."
How the attack reportedly unfolded: Chainalysis's account, pieced together across several updates, points to at least two separate problems. Some customers' passwords were captured through an "on-path attack," where an intruder intercepts traffic between a user and the service; the company says that route is now closed. Separately, it says a malicious actor used "offensive agentic techniques" to get into internal systems, without clarifying whether that means an autonomous AI agent, AI-assisted hacking tools, or something else. It also hasn't said whether the interception, the exposed hashes and tokens, and the suspected KYT account access are connected.
The response and what's still unclear: Chainalysis took its Reactor investigations tool, Data Solutions, Chain (Beta), KYT, its address-screening products and its login page offline while it rebuilds access around an allowlist of trusted customer IP addresses. It told every user to reset passwords and rotate API keys once service returns, and warned people to go to its login page directly rather than click reset-email links, a nod to phishing risk. No date has been given for restoring the investigations tools, and the company hasn't explained how customers screened transactions while KYT was down.