Customers of blockchain intelligence company Chainalysis are being warned to watch for impersonation attempts after intruders reached information about platform users. In an incident disclosed Friday and reported by BleepingComputer on October 31, the company said attackers entered internal systems and tools using what it termed “offensive agentic techniques.”
The information accessed included full names, email addresses, user IDs and labels describing users’ organizational roles. Chainalysis is examining which records were reached at each organization and intends to send affected customers a detailed breakdown once that work is finished.
Its customers include law enforcement bodies, government agencies, cryptocurrency exchanges and financial institutions. They use its blockchain analysis tools to follow cryptocurrency transactions during investigations into fraud, ransomware and money laundering. Chainalysis says its investigation so far has found no evidence that the intruders accessed investigation content, authentication credentials or session tokens, which maintain signed-in sessions.
Detection preceded Friday’s disclosure
Chainalysis published its incident notice and the text of its email to affected customers at approximately 5:14 p.m. ET on Friday, October 30. The company said it detected the outside actor’s unauthorized access earlier in October and has since worked to patch vulnerabilities and strengthen its defenses.
A company spokesperson told BleepingComputer that external cybersecurity specialists are assisting with the response. Chainalysis is also bringing large language models—AI systems that process and generate text—into a wider security review of its platform.
The company says the breach is unrelated to the recent Binance theft.
What “agentic” means here
Agentic AI can perform a sequence of tasks with limited human direction. Applied to offensive security, that could involve finding a weakness, attempting to exploit it and choosing another action based on the result.
Chainalysis’s description leaves open whether the intruders used a ready-made framework such as ARTEX or developed their own agents; the vulnerabilities involved, internal tools reached and duration of access remain unspecified. Its wording therefore gives customers a broad description of the attack approach rather than a technical account of the intrusion.
There is a documented example of such tools being used elsewhere. In its October 21 report, Microsoft said the China-state aligned actor Storm-0940 had used ARTEX, an AI framework for automated security testing, against hundreds of organizations worldwide as early as September 2026, obtaining privileged cloud access in several attacks—including multiple cases taking less than three hours from initial targeting—and assessed that the actor was responsible for the separate ConnectWise supply-chain compromise.
Steps for Chainalysis customers
Chainalysis advises customers to enable two-factor authentication, which adds a verification step when signing in. Customers should also watch for password-reset requests they did not initiate, unexpected authentication prompts and people posing as Chainalysis representatives. The company specifically warned about impersonators offering cryptocurrency fund-recovery services or recruiting opportunities.
Chainalysis plans to provide further updates as the investigation progresses. Its forthcoming organization-specific notices will detail which records were accessed; customers should meanwhile follow its advice to enable two-factor authentication and remain alert to those impersonation attempts.
