Intruder accessed user data at blockchain analytics firm Chainalysis

Blockchain analytics firm Chainalysis says an outside attacker got into its systems and internal tools in October. The attacker accessed user IDs, full names, email addresses and organization role labels for users on its platform. It says it has found no evidence that investigation content, passwords in clear text, MFA secrets or session tokens were accessed. Chainalysis has notified all of its customers and is patching the flaws the attacker exploited.

Chainalysis says the attacker used agentic techniques, and it points to an industry-wide rise in AI-driven attacks. It hasn’t said which flaws the attacker exploited, which systems and tools it reached or when the intrusion began. It says it’s working with outside security experts and using large language models in a broader review of its platform’s security.

The records belong to users provisioned on the Chainalysis platform, and Chainalysis told each customer it wrote to that records about its own organization and users were among them. It is still working out which records were accessed for each organization, and says each will get a detailed breakdown. Some customers had been told earlier, and the notice updated them.

By investigation content, Chainalysis means the graphs, notes and cases its users build. It says it also found no sign that the attacker reached transaction or query results.

Chainalysis published the text of its customer email on Oct 30. It says the incident is unrelated to the theft of cryptocurrency from Binance. It tells users to watch for unexpected password reset requests or sign-in prompts, and to turn on two-factor authentication.

Chainalysis hasn’t said how many customers or users are affected, or who was behind the intrusion.