Chainalysis disclosed a "multifront cyberattack" in October that exposed sensitive data for all of its users, including names, usernames, password hashes, and live tokens. The blockchain analysis firm serves high-profile customers including the FBI, US Immigration and Customs Enforcement, the US Air Force, Microsoft, Coinbase, and Barclays.
The attack involved AI agent-assisted techniques to gain unauthorized access to Chainalysis systems. An on-path attack, also known as an adversary-in-the-middle attack, exposed a subset of customer passwords by compromising infrastructure that routes traffic between parties.
Chainalysis discovered the broader data exposure on Monday but did not disclose it until Wednesday. The company took down its login page, know-your-transaction service, Reactor, and Data Solutions services in response. It began restoring access to some services on Friday and made credential rotation mandatory for all customers. Chainalysis asked customers to submit trusted IP addresses for an allow list.
The company said its investigation found no evidence that investigation data was accessed or that attribution data was manipulated. However, several questions remain unanswered. The source of the on-path attack infrastructure compromise has not been identified. Chainalysis provided no details about how the AI agents functioned or why it delayed disclosure of the full breach. The company declined to comment beyond its blog post statements.