Chainalysis says hacker using 'offensive agentic techniques' accessed customer names and emails
Blockchain analytics firm Chainalysis said an outside attacker gained unauthorised access to its systems and internal tools this month and viewed customer names, email addresses, user IDs and role labels. The company said it has found no evidence that investigation content, credentials or session tokens were accessed, and that the incident is unrelated to the Binance theft.
Chainalysis, a blockchain analytics company whose tools are used by law enforcement agencies, government bodies, cryptocurrency exchanges and banks to trace crypto transactions, said an outside attacker gained unauthorised access to its systems and internal tools this month.
What Chainalysis said. In a security notice posted on its website on Friday 30 October, at about 21:14 GMT according to BleepingComputer, the company said it detected “an external actor using offensive agentic techniques” to gain access to Chainalysis systems and internal tools. The term “agentic” generally refers to AI systems that can carry out multi-step tasks with limited human input, BleepingComputer noted. Chainalysis has not said which vulnerabilities were exploited or how long the attacker had access.
What was accessed. Chainalysis said “non-sensitive customer data, such as user IDs, full names, email addresses, and organization role labels” for users on its platform was accessed. It said it had found no indication that investigation content such as graphs, notes or cases, transaction or query results, passwords in clear text, multi-factor authentication secrets or user session tokens were accessed. The company said it is still working out which records were accessed for each customer organisation and has notified all customers.
Response. Chainalysis said it has engaged outside cybersecurity experts and is using large language models to support a wider review of its platform’s security. It advised users to watch for unexpected password reset requests or login prompts and to enable two-factor authentication. The company said the incident “is not related to the recent crypto theft at Binance”.
See also: the FBI’s statement on the Binance theft.
Sources
Related coverage
All crypto →
GMO Internet Group analysis points to North Korea-linked hackers behind October cyberattack, Kyodo reports
An internal analysis by Japanese internet infrastructure company GMO Internet Group found that a hacking group linked to North Korea was likely behind last month's cyberattack on the company, Kyodo News reported on Sunday, citing sources close to the matter.
FBI says North Korea was responsible for the more than $6 billion theft from Binance
The FBI said on Saturday that North Korea, through the unit it calls TraderTraitor, was responsible for the theft from Binance on or about 29 October. TRM Labs and Chainalysis had earlier assessed the same group. Binance says users will not bear the loss and that it has replenished about 90% of the stolen assets.
Binance says it has covered 90% of the $6.3 billion stolen in its hack and is on track to resume withdrawals on 1 November
Binance said on Saturday that it has restored backing for about 90% of the token assets stolen from its hot wallets, using company funds, part of its SAFU emergency fund and part of its futures insurance fund. It says users will not bear the loss and that withdrawals should resume on 1 November, subject to security checks.
Japan Airlines says hackers accessed booking data of about 92,000 customers through Amadeus system
Japan Airlines and Japan Transocean Air say unauthorised access to the Amadeus passenger service system exposed reservation records of about 92,000 customers between August 2023 and September 2026, including passport numbers for about 2,000. The airline says no card numbers or passwords were taken.
Coinbase says analytics vendor Amplitude's security incident exposed some customer contact data
Coinbase said a security incident at analytics provider Amplitude affected contact data for a 'small subset' of its customers. The exchange said its own systems were not breached and customer funds were not affected.
Nikkei says 1.83 million personal data items leaked after cloud account breach
The Japanese media group said stolen credentials were used to access a cloud service used for system development on 7 October.
