Chainalysis investigates AI-powered intrusion exposing user data

Chainalysis says it was the target of a cyber security incident in October, with a threat actor gaining access to its systems and internal tools using what the company describes as offensive agentic techniques powered by AI. The firm states it detected the intrusion this month and that non-sensitive customer data were accessed.

Specifically, attackers reached user IDs, full names, email addresses and organisation role labels for users on the platform, while investigators are still determining exactly which records belonged to which customer. Chainalysis notes that there was no evidence of access to investigation content (such as graphs, notes or cases), transaction or query results, or to passwords in clear text, MFA secrets or user session tokens.

Chainalysis says it is patching vulnerabilities and hardening its systems around the clock, has engaged outside cybersecurity experts and is using large language models to support a wider review beyond the flaws used by the attacker. The firm has notified all customers and will provide a detailed breakdown of impacted records as the analysis progresses.

It recommends customers watch for unexpected password reset requests or login approval prompts, and strongly urges enabling two-factor authentication for all organisations not yet using it, noting that the exposed data could be used to launch phishing campaigns. The incident, the company emphasises, is not connected to the recent $6 billion Binance theft.