Chainalysis

Record description

Chainalysis provides blockchain investigations, compliance monitoring and related data services. Its rolling October 30 to November 4 incident notice says an external actor used offensive agentic techniques against internal systems. The company does not identify the model, initial access method, agent tool calls or level of autonomy; its separate use of large language models for defensive investigation is not evidence about the attacker's tools.

The disclosure changed materially over time. Initially, Chainalysis reported user identifiers, names, email addresses and organization-role labels without known password or session-token exposure. On November 4 it described some customer passwords exposed through an on-path attack; a late update said names, usernames, password hashes and live tokens for all platform users had been exposed. It also took screening and investigative products offline during the response and outlined plans for allowlisted access, password resets and API-key rotation. Plans are not verified completion. The Chainalysis Case retains that disclosure history. The company explicitly says this event is unrelated to Binance's October theft; these incidents must not be attributed to the same campaign on the basis of shared AI vocabulary.

Explicitly related research (2)

Declared connections