Chainalysis discloses data breach involving offensive agentic AI techniques

American blockchain intelligence and analysis firm Chainalysis disclosed a cybersecurity incident on Friday at roughly 5:14 PM ET, reporting that an external actor used "offensive agentic techniques" earlier this month to gain unauthorised access to its systems and internal tools. The company, which provides blockchain analytics tools to law enforcement, government agencies, cryptocurrency exchanges, and financial institutions to trace cryptocurrency transactions and investigate fraud, ransomware, and money laundering, published the disclosure alongside the full text of an email sent to affected customers.

According to Chainalysis, the attackers accessed non-sensitive customer information, including full names, email addresses, user IDs, and organisational role labels for users provisioned on the platform. "Based on the investigation to date, we have found no evidence of unauthorized access to investigation content, authentication credentials, or session tokens," the company stated, adding that the breach is unrelated to the recent Binance theft.

Chainalysis has not shared technical details regarding which vulnerabilities were exploited, which internal tools were accessed, or how long the attackers had access. The term "agentic" generally describes artificial intelligence (AI) systems capable of executing multi-step tasks with limited human intervention. It remains unclear whether the attackers used custom-built AI agents or existing agentic offensive security frameworks such as ARTEX, which Microsoft reported was recently used in the ConnectWise supply chain compromise.

A spokesperson confirmed to BleepingComputer that Chainalysis is working with external cybersecurity experts, patching vulnerabilities, hardening its systems, and using large language models (LLMs) to support a broader security review of its platform. "We are seeing an industry-wide rise in AI-driven cyber attacks, and we are taking a whole-of-company approach to make sure our security posture meets the evolving environment and our customers' expectations," the company said.

Chainalysis is still determining which records were accessed for each organisation and will provide a detailed breakdown once that analysis is complete, alongside further updates for affected customers as its investigation progresses. Customers are advised to enable two-factor authentication (2FA) and watch for unexpected password reset requests, authentication prompts, and scammers impersonating Chainalysis, particularly those offering fund recovery or recruiting services.

Sources: BleepingComputer, The Hacker News

Written with AI and fact-checked against the linked sources by an automated AI review before publication. Spotted an error? See our Corrections Policy.