Blockchain intelligence enterprise Chainalysis disclosed that an unknown intruder utilizing "offensive agentic techniques" breached its internal systems and applications this month, gaining entry to certain "non-sensitive" customer information, as detailed in an alert delivered to impacted clients.
Chainalysis released the complete wording of the notification via a blog post on Friday evening. The perpetrator gained entry to "some non-sensitive customer data, such as user IDs, full names, email addresses, and organization role labels for users provisioned on our platform," the organization stated, committing to dispatch a subsequent update to every client specifying exactly which records were compromised.
"Based on the evidence available to date, we have found no indication that these incidents resulted in the unauthorized access of investigation content (such as graphs, notes, or cases), transaction or query results, passwords in clear text, MFA secrets, or user session tokens," Chainalysis noted.
Chainalysis omitted the timestamp of when it identified the breach, which was initially highlighted by International Cyber Digest, the exact scale of impacted users, the specific system flaws leveraged by the intruder, or the precise mechanism by which AI agents facilitated the attack. Chainalysis declined to address specific inquiries posed subsequently by The Block.
Chainalysis stated it has engaged external cybersecurity specialists and is leveraging large language models to assist in a comprehensive security audit of its infrastructure. The company recommended that affected businesses enable multi-factor authentication and maintain vigilance regarding unusual events like unexpected password reset prompts or verification requests.
Chainalysis breach “not related” to Binance hack
Chainalysis indicated the security event is "not related to the recent crypto theft at Binance." Chainalysis, Elliptic, and TRM have each attributed the roughly $6.3 billion Binance exploit to North Korean threat actors, which, according to Binance, succeeded in compromising an engineer’s laptop and accessing a service container. Nonetheless, exchange co-CEO Richard Teng asserted that the incident was more sophisticated than a mere compromise of a single staff member’s access privileges.
On Ethereum, the malicious actor utilized EIP-7702 to convert a Binance hot wallet into a sweeper, as previously reported by The Block. The sweeper smart contract consisted of approximately 130 lines, Immunefi Vice President Simone Imbrescia observed in a commentary provided to The Block. "The hard part sometimes is getting access to a system powerful enough to make very simple code devastating," Imbrescia remarked.
Chainalysis, which estimates the total stolen amount at $6.4 billion, has persisted in tracking the misappropriated assets. On Friday, the organization reported observing "never-seen-before laundering patterns," featuring thousands of transfers executed within a brief window, indicating the culprits utilized automation to obscure the transaction chain. Instead of simply forwarding capital to fresh destinations, the perpetrators circularly routed the pilfered cryptocurrency among multiple wallets, frequently returning funds to addresses utilized earlier in the sequence, the organization explained, publishing a chart illustrating the movement of capital.
On Saturday, Chainalysis announced that the perpetrators leveraged decentralized finance lending markets on the Tron network to evade stablecoin freezes since the onset of the offensive. The hackers exchanged Tron’s native TRX asset for various stablecoins and deposited them into a borrowing protocol, recognized by blockchain analysts Specter and Ian Unsworth as JustLend, in exchange for receipt tokens, which cannot be frozen by stablecoin operators. Subsequently, the attackers transferred those certificates to sanitized wallets, reclaimed them for stablecoins, and bridged the capital away from Tron, converting them into ETH on another chain, according to the enterprise.
"Now the exploiter is free of worry of a freeze," the firm wrote. The Saturday discussion thread published by Chainalysis noted that roughly $2.8 billion worth of stablecoins have already been frozen by issuers including Circle and Tether. "Of course, exchanging stablecoins for ETH does not make the hackers bulletproof," Chainalysis added.
Originally published at https://www.theblock.co/news/business/2026-10-31-chainalysis-says-hacker-using-offensive-agentic-techniques-accessed-its-customers-names-and-emails-432244.
