SECURITY ALERT
The firm that follows stolen money had visitors of its own.
They left with the guest list.
Chainalysis, the blockchain analytics company whose tools are used to trace hacks, says an outside actor broke into its systems and internal tools this month.
The intruder used “offensive agentic techniques”, the company said in a notice posted on Friday, 30 Oct. In plain terms: software agents that probe, plan and act with little human steering.
What was taken, according to Chainalysis: user IDs, full names, email addresses and “organization role labels” for people with accounts on its platform.
What it says was not: investigation content such as graphs, notes or cases, transaction or query results, cleartext passwords, multi-factor authentication (MFA) secrets and session tokens.
“This security incident is not related to the recent crypto theft at Binance,” the company said.
What happened, in UTC
- October, date not given. Chainalysis detects an external actor inside its systems and internal tools.
- Before 30 Oct. Some customers are notified. The notice says “some of you have been previously notified.”
- Friday 30 Oct, 21:14. Chainalysis publishes its notice, with the full text of the email sent to affected customers.
- Saturday 31 Oct, 11:22. Cointelegraph reports the incident.
- 13:27. The Block follows.
So how many records left?
Known, and not yet known
Chainalysis has not said.
It is still working out which records were accessed for each customer and will send “a detailed breakdown” once that analysis is done.
It has not named the intruder, said how it got in, or said how many accounts are involved.
It calls the data “non-sensitive”. Next to a password, perhaps. It is less true of a list of who, at which organisation, holds which role on an investigations platform.
The company says it has hired outside security experts and is using large language models to review its platform. It describes a wider rise in automated cyberattacks across tech platforms in recent weeks.
The timing is hard to miss. Chainalysis is one of the firms tracing this week’s theft at Binance.
If the names are the payload, what is the next message they receive?
The pattern
This is the third data incident in a week that runs through a service rather than a wallet, after Coinbase’s analytics vendor and Foundation’s phishing emails. Earlier on Saturday, CryptoWatchDesk reported on hijacked DeFi front ends.
The month’s money losses are on a different scale. CertiK’s dashboard counts $6.50 billion lost to 89 incidents in October, or $3.47 billion after $3.03 billion frozen or returned.
Protect yourself
- If you use Chainalysis, treat unexpected password-reset emails and login prompts as suspect, as the company advises.
- Turn on two-factor authentication, preferably an authenticator app or hardware key rather than SMS codes.
- Check any “Chainalysis” message about a case or a Binance trace against a contact you already know, not a link in the email.
- Anyone in crypto compliance: expect phishing that knows your name, employer and job title.
When the investigators’ address book leaks, who warns the investigators?
Corrections and new evidence: [email protected]
This article is for information only and is not investment advice.