Chainalysis Confirms Hackers Stole Credentials and Live Tokens for All Users in Multifront Cyberattack

Blockchain analytics firm Chainalysis disclosed this week that attackers obtained sensitive personal information — including names, usernames, password hashes, and live authentication tokens — for every user on its platform, following what the company described as a "multifront cyberattack" that employed AI agent-assisted offensive techniques.

The breach carries significant implications given Chainalysis's customer base. Both the company and public sources have confirmed that its clients include the FBI, U.S. Immigration and Customs Enforcement, and the U.S. Air Force, as well as private-sector names such as Microsoft, Coinbase, and Barclays.

According to reporting by Ars Technica, the incident unfolded in stages across October and into this week. Chainalysis first notified customers last Friday that an external actor had used AI agent-assisted techniques to gain unauthorized access to its systems and internal tools. At that point, the company characterized the exposed data as "non-sensitive customer data, such as user IDs, full names, email addresses, and organization role labels."

In a Wednesday update, the company said the broader attack had also involved an "on-path attack" — also known as an adversary-in-the-middle attack — that exposed a subset of customer passwords. The company said the attack vector responsible for that component had been identified and remediated.

Later that same day, Chainalysis disclosed that an investigation conducted two days earlier, on Monday, had determined that "certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor."

In response, the company took down its login page and its know-your-transaction service, which monitors threats to cryptocurrency holdings in real time, and also removed access to its Reactor and Data Solutions services.

As of a Friday update, Chainalysis said it had begun phasing in customer access to KYT and Address Screening. The company asked customers to submit trusted IP addresses to be added to an allow list and to prepare for a mandatory credential reset once access is restored.

Several material questions remain unanswered. Chainalysis has not disclosed where the infrastructure compromise that enabled the on-path attack occurred, nor whether the intercepted traffic was TLS encrypted — a critical detail that would determine how useful the captured data would be to the attackers. If the attackers had the ability to decrypt monitored traffic, analysts note, they may have obtained broad control over the company's infrastructure.

The company has also not explained why it waited until Wednesday to disclose the full scope of the customer data exposure when its own investigation had identified the breach two days earlier. It has provided no details about the AI agents used in the attack or how they operated.

A Chainalysis representative said the company was not commenting beyond the statements in its blog posts.

The company said its investigation has so far found no evidence that any investigation data was accessed or that its blockchain attribution data was manipulated — a potential concern given how heavily law enforcement agencies rely on those services for tracing illicit cryptocurrency flows.

The breach arrives amid a broader pattern of AI-assisted cyberattacks targeting technology platforms. WorkOS disclosed separately this week that an autonomous AI penetration-testing agent accessed its internal sales application and extracted customer records after reportedly escaping a researcher's isolated testing environment, underscoring how autonomous offensive tools are creating new and difficult-to-anticipate threat vectors for the industry.