---
id: "CMP-202610-chainalysis-breached-by-an-attacker-using-ai-agent-tooling-n"
kind: "campaign"
aliases: []
title: "Chainalysis breached by an attacker using AI agent tooling: names, emails, user IDs and roles of customer platform users exposed"
severity: "medium"
cvss: null
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Chainalysis", "fixed": [], "ecosystem": "saas"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-10-31T12:44:16+00:00"
updated_at: "2026-10-31T12:44:16+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-31T12:44:16+00:00"}]
---

# Chainalysis breached by an attacker using AI agent tooling: names, emails, user IDs and roles of customer platform users exposed

Chainalysis, the blockchain analysis firm, confirmed on 30 Oct 2026 that an outside attacker using 'offensive agentic techniques' (AI-driven attack tooling) got into its systems and internal tools earlier in October 2026. The attacker accessed the user IDs, full names, email addresses and organisation role labels of users provisioned on the Chainalysis platform, including details of customer organisations. Chainalysis says investigation content, authentication credentials and session tokens were not accessed, and that it is patching vulnerabilities and hardening its systems. How the attacker got in, who it is and the exact dates are unknown. At risk: organisations that use Chainalysis products (exchanges, crypto firms, banks, law enforcement and compliance teams). Their staff can now be targeted by phishing that uses real names and roles, which matters given the recent attacks on crypto platforms.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- saas:Chainalysis affected ? fixed ?

## How to check

Find out whether your organisation has users on Chainalysis (Reactor, KYT or other platform accounts) and whether Chainalysis sent you a breach notice. Watch for phishing or social engineering aimed at those users by name and role, especially messages that pretend to be Chainalysis or that use investigation or compliance pretexts. Indicators of compromise: none published (unknown).

## Fix

Tell staff with Chainalysis accounts to expect targeted phishing and to verify any request that claims to come from Chainalysis through a known contact. Make sure phishing-resistant MFA or SSO is enforced on Chainalysis accounts and review their recent logins. Rotating credentials is optional, since Chainalysis says none were taken. Follow Chainalysis's notice for updates.

## Timeline

- 2026-10-31T12:44:16+00:00 analyst

## Documents

- [describes] @TheHackersNews: 🚨 Blockchain analysis firm Chainalysis confirms a data breach involving offensiv https://x.com/TheHackersNews/status/2116501537140961586
- [describes] Chainalysis Confirms Intrusion Into Internal Tools and Exposure of Customer Identity Data (The Hacker News) https://thehackernews.com/
- [discussion] @BleepinComputer: Chainalysis discloses data breach from "offensive agentic techniques"
https://t. https://x.com/BleepinComputer/status/2116513123347628212
- [discussion] BleepingComputer: Chainalysis discloses data breach from "offensive agentic techniques" https://www.bleepingcomputer.com/news/security/chainalysis-discloses-data-breach-from-offensive-agentic-techniques/

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_