Pierluigi PaganiniNovember 02, 2026
Chainalysis suffered a cyberattack exposing customer names, emails and user IDs, while investigation data and passwords remain safe.
Blockchain analytics firm Chainalysis says it was the target of a cybersecurity incident. A threat actor accessed its systems and internal tools and stole some non-sensitive customer data.
“This month, Chainalysis detected an external actor using offensive agentic techniques to gain unauthorized access to Chainalysis systems and internal tools.” reads the statement published by the company, which also includes the full email sent to affected customers.
Chainalysis says it discovered the attacker this month and described the methods used as offensive techniques involving AI agents. However, it did not explain how the attack was carried out. The company also warned that AI-powered attacks are becoming more common across the industry and said it is taking a company-wide approach to dealing with this growing threat.
The data the attacker reached matters most. According to Chainalysis, attackers gained access to user IDs, full names, email addresses and organization role labels for users on the platform. The company is still working out which records belong to which customer and promises a detailed breakdown when it finishes.
What the attacker didn’t reach is just as important. So far, Chainalysis has found no sign of access to investigation content such as graphs, notes or cases, or to transaction and query results. It also found no clear-text passwords, MFA secrets or user session tokens in the attacker’s hands.
“Based on the evidence available to date, we have found no indication that these incidents resulted in the unauthorized access of investigation content (such as graphs, notes, or cases), transaction or query results, passwords in clear text, MFA secrets, or user session tokens.” continues the press release.
Some non-sensitive customer data, such as user IDs, full names, email addresses, and organization role labels for users provisioned on our platform were accessed, including such information relating to your organization and users. We are in the process of determining the records for your organization that were accessed and will provide a detailed breakdown as soon as that analysis is complete.“
The company says it’s patching vulnerabilities and hardening its systems around the clock. It has hired outside cybersecurity experts and is using large language models to support a wider review that goes beyond the flaws the attacker used. It has already told all its customers and will keep them updated.
Chainalysis advises customers to watch out for unexpected password reset requests or login approval prompts. The company also strongly recommends enabling two-factor authentication (2FA) for all organizations that have not already done so. Since the exposed data includes names and email addresses, attackers could use it to launch phishing campaigns.
The company also clarified that the security incident has nothing to do with the recent theft of more than $6 billion from Binance.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Chainalysis)
AIChainalysisHackinghacking newsinformation security newsIT Information SecurityPierluigi PaganiniSecurity AffairsSecurity News
