Chainalysis, the Firm Police Use to Trace Crypto Hackers, Says Attackers With AI Agents Broke Into Its Systems

The company investigators call when crypto gets stolen has been broken into itself. Chainalysis told customers on Friday that an outsider got into its systems using AI agents, and accessed the names and email addresses of people on its platform.

Those people are the problem. Chainalysis sells its tracing tools to law enforcement, government agencies, crypto exchanges and financial institutions, so its user list is a directory of people who chase fraud, ransomware and money laundering for a living.

"This month, Chainalysis detected an external actor using offensive agentic techniques to gain unauthorized access to Chainalysis systems and internal tools," the company said in the email it published.

What the attacker got

The company calls the accessed data "non-sensitive": user IDs, full names, email addresses and organization role labels. It is still working out which records were accessed for each organization and has promised a detailed breakdown. It has not said how many people are affected.

Chainalysis says it has found no evidence of access to investigation content such as graphs, notes and cases, or to transaction and query results. It says the same of clear-text passwords, MFA secrets, authentication credentials and session tokens.

That list matters more than usual here. Investigation data could let a third party snoop on live cases, Infosecurity Magazine points out, and the firm spent the week helping work out who carried out the Binance raid.

Chainalysis was among the firms that linked that roughly $6.3 billion theft to North Korea. It says its own incident is unrelated.

The missing details

The disclosure leaves out most of what defenders would want to know. Chainalysis has not said which vulnerabilities were exploited, which internal tools were reached or how long the attackers had access.

The phrase "offensive agentic techniques" also goes unexplained. BleepingComputer notes it is unclear whether the attackers used custom agents or an existing framework such as ARTEX, which Microsoft says threat actors used in the ConnectWise supply chain compromise.

Chainalysis describes this as part of an industry-wide rise in AI-driven attacks, with many tech platforms hit in recent weeks. It is now answering with the same technology. Alongside outside cybersecurity experts, the company says it is "using sophisticated large language models to support a broader review of our platform's security."

"Our teams have been working around the clock to investigate unauthorized activity, patch vulnerabilities, and harden our systems," it said.

A target list for phishers

A name, an email address and a role label are exactly what a convincing scam needs. Chainalysis seems to know it. It has told customers to be "hyper-vigilant of unexpected password reset requests or authentication prompts," to turn on two-factor authentication and to watch for scammers impersonating the company, particularly those offering fund recovery or recruiting services.

For now, the firm that follows the money has to explain how someone got inside its own house.

Some offers on this page may be paid placements or contain affiliate links.