Chainalysis Reports Breach by Attackers Using AI Agents
The blockchain analytics firm says an outside actor reached internal tools and customer names and emails. It reports no sign that investigation data or credentials were taken.
Chainalysis, a blockchain intelligence company, has disclosed a security incident in which an outside actor used what the firm calls "offensive agentic techniques" to get into its internal systems and tools.
The company published the disclosure on Friday at about 5:14 PM ET. It also released the full text of the email it sent to affected customers. According to the disclosure, the intrusion was detected earlier this month. Since then, Chainalysis has been patching vulnerabilities and hardening its systems.
Some customer information was accessed. It covers user IDs, full names, email addresses and organizational role labels for users provisioned on the platform. Which records belong to which organization is still being worked out. A detailed breakdown is promised once that analysis is done.
What the company says was not touched
"Based on the investigation to date, we have found no evidence of unauthorized access to investigation content, authentication credentials, or session tokens," a company spokesperson said. The spokesperson also said the incident is unrelated to the recent Binance theft.
Chainalysis is working with external cybersecurity experts. It is also using large language models to support a broader security review of its platform.
Customers are advised to enable two-factor authentication. They should also watch for unexpected password reset requests and authentication prompts. Another warning concerns scammers who impersonate Chainalysis, particularly those offering fund recovery or recruiting services.
Chainalysis supplies analytics tools to law enforcement, government agencies, crypto exchanges and financial institutions. They use them to trace transactions and investigate fraud, ransomware and money laundering.
Open questions
Technical details have not been shared. The company has not said which vulnerabilities were exploited, which internal tools were reached or how long the attackers had access. It is also unclear whether they used an existing agentic offensive framework or custom-built AI agents.
The term "agentic" generally describes AI systems that can carry out multi-step tasks with limited human intervention. Further updates will go to affected customers as the investigation continues.
Source: BleepingComputer