{"id":"CMP-202610-chainalysis-breached-by-an-attacker-using-ai-agent-tooling-n","kind":"campaign","aliases":[],"related":[],"title":"Chainalysis breached by an attacker using AI agent tooling: names, emails, user IDs and roles of customer platform users exposed","description":null,"summary":"Chainalysis, the blockchain analysis firm, confirmed on 30 Oct 2026 that an outside attacker using 'offensive agentic techniques' (AI-driven attack tooling) got into its systems and internal tools earlier in October 2026. The attacker accessed the user IDs, full names, email addresses and organisation role labels of users provisioned on the Chainalysis platform, including details of customer organisations. Chainalysis says investigation content, authentication credentials and session tokens were not accessed, and that it is patching vulnerabilities and hardening its systems. How the attacker got in, who it is and the exact dates are unknown. At risk: organisations that use Chainalysis products (exchanges, crypto firms, banks, law enforcement and compliance teams). Their staff can now be targeted by phishing that uses real names and roles, which matters given the recent attacks on crypto platforms.","severity":"medium","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-10-31T12:44:16+00:00","products":[{"name":"Chainalysis","fixed":[],"ecosystem":"saas"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Find out whether your organisation has users on Chainalysis (Reactor, KYT or other platform accounts) and whether Chainalysis sent you a breach notice. Watch for phishing or social engineering aimed at those users by name and role, especially messages that pretend to be Chainalysis or that use investigation or compliance pretexts. Indicators of compromise: none published (unknown).","fix":"Tell staff with Chainalysis accounts to expect targeted phishing and to verify any request that claims to come from Chainalysis through a known contact. Make sure phishing-resistant MFA or SSO is enforced on Chainalysis accounts and review their recent logins. Rotating credentials is optional, since Chainalysis says none were taken. Follow Chainalysis's notice for updates.","status":"open","published_at":null,"first_seen_at":"2026-10-31T12:44:16+00:00","triaged_at":"2026-10-31T12:44:16+00:00","updated_at":"2026-10-31T12:44:16+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202610':22A '2026':48B,72B '30':46B 'access':75B,110B 'address':82B 'agent':8A,31A,55B 'ai':7A,30A,58B 'ai-driven':57B 'an':27A 'analysi':42B 'attack':5A,52B,60B,74B,123B,170B 'attacker':28A 'authent':103B 'bank':145B 'blockchain':41B 'breach':2A 'breached':25A 'by':26A 'campaign':35B 'chainalysi':1A,39B,92B,99B,140B 'chainalysis':24A,34A 'chainalysis-breached-by-an-attacker-using-ai-agent-tooling-n':23A 'cmp':21A 'complianc':149B 'confirm':44B 'content':102B 'credenti':104B 'crypto':143B,172B 'custom':17A,97B 'date':132B 'detail':95B 'driven':59B 'earli':37B 'earlier':69B 'early-warn':36B 'email':11A,81B 'enforc':147B 'exact':131B 'exchang':142B 'expos':20A 'firm':43B,144B 'full':79B 'given':167B 'got':62B,124B 'harden':118B 'id':13A,78B 'includ':94B 'intern':67B 'investig':101B 'label':86B 'law':146B 'matter':166B 'n':33A 'name':10A,80B,162B 'oct':47B 'octob':71B 'offens':54B 'organis':84B,98B,137B 'outsid':51B 'patch':115B 'phish':158B 'platform':18A,93B,173B 'product':141B 'provis':89B 'real':161B 'recent':169B 'risk':136B 'role':15A,85B,164B 'say':100B 'session':106B 'staff':152B 'system':65B,120B 'target':156B 'team':150B 'techniqu':56B 'token':107B 'tool':9A,61B,68B 'tooling':32A 'unknown':134B 'use':6A,53B,139B,160B 'user':12A,19A,77B,88B 'using':29A 'vulner':116B 'warn':38B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-31T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-chainalysis-breached-by-an-attacker-using-ai-agent-tooling-n","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-31T12:44:16+00:00","fetched_at":"2026-10-31T12:44:16+00:00","note":null}],"documents":[{"id":32076,"url":"https://x.com/TheHackersNews/status/2116501537140961586","title":"@TheHackersNews: 🚨 Blockchain analysis firm Chainalysis confirms a data breach involving offensiv","kind":"post","source":"x","publisher":null,"text":"🚨 Blockchain analysis firm Chainalysis confirms a data breach involving offensive agentic techniques.\n\nAn attacker gained access to internal systems and tools, exposing customer names, email addresses, user IDs, and organization roles.\n\nFull story: https://t.co/T17DPwfGnI\n\nlikes 50 reposts 14","published_at":"2026-10-31T12:04:23+00:00","relation":"describes","confidence":null,"note":null},{"id":32296,"url":"https://thehackernews.com/","title":"Chainalysis Confirms Intrusion Into Internal Tools and Exposure of Customer Identity Data (The Hacker News)","kind":"other","source":"analyst","publisher":null,"text":"Chainalysis said (Friday 30 Oct 2026) that this month an external actor using offensive agentic techniques gained unauthorized access to Chainalysis systems and internal tools. Accessed: user IDs, full names, email addresses, organization role labels of users provisioned on its platform. Not accessed per Chainalysis: investigation content, authentication credentials, session tokens. Patching vulnerabilities and hardening. Methods not disclosed.","published_at":"2026-10-31T00:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":32315,"url":"https://x.com/BleepinComputer/status/2116513123347628212","title":"@BleepinComputer: Chainalysis discloses data breach from \"offensive agentic techniques\"\nhttps://t.","kind":"post","source":"x","publisher":null,"text":"Chainalysis discloses data breach from \"offensive agentic techniques\"\nhttps://t.co/YqcEWKa1oi\n\nhttps://t.co/YqcEWKa1oi\n\nlikes 7 reposts 0","published_at":"2026-10-31T12:50:26+00:00","relation":"discussion","confidence":null,"note":null},{"id":32375,"url":"https://www.bleepingcomputer.com/news/security/chainalysis-discloses-data-breach-from-offensive-agentic-techniques/","title":"BleepingComputer: Chainalysis discloses data breach from \"offensive agentic techniques\"","kind":"blog","source":"blog","publisher":null,"text":"Chainalysis discloses data breach from \"offensive agentic techniques\"\n\nBlockchain analytics firm Chainalysis disclosed a data breach after attackers used \"offensive agentic techniques\" to access internal systems and tools, exposing customer names, email addresses, user IDs, and organizational roles. [...]","published_at":"2026-10-31T12:50:09+00:00","relation":"discussion","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}