Chainalysis reports incident involving agentic techniques

In its October 30, 2026 security notice, Chainalysis said it had recently been the target of a cybersecurity incident.[1] The company said an external actor used offensive agentic techniques to gain unauthorized access to its systems and internal tools.[1] Chainalysis described some of the affected customer information as non-sensitive, and said the information related to customers’ organizations and users.[1] The notice’s quoted material mentions full names and email addresses, while Chainalysis said it was still determining which records for each organization had been accessed.[1]

Chainalysis said some non-sensitive customer data included user IDs, and that organization role labels for users on its platform were accessed.[1] It said it had found no evidence of unauthorized access to investigation content.[1] The notice’s quoted material also mentions authentication credentials, session tokens, transaction or query results, passwords in clear text and MFA secrets.[1] Chainalysis said it was still determining which records for each organization had been accessed, so the notice did not yet provide a complete organization-by-organization account.[1]

Chainalysis said it had proactively notified all customers and was working with cybersecurity experts to investigate the incident and harden its systems.[1] It also said its teams were investigating unauthorized activity and patching vulnerabilities, while large language models were supporting a broader review of platform security.[1] The company said it would provide customers with a detailed breakdown of accessed records once its analysis was complete and update them as the investigation progressed.[1] It advised users to remain alert for unexpected password-reset requests or authentication prompts and strongly recommended two-factor authentication for organizations that had not enabled it.[1]

Chainalysis said the incident was unrelated to the recent crypto theft at Binance.[1] Its notice does not give a completed accounting of the records accessed for each organization; the company said that work was still underway.[1] For customers, the practical next step is to follow the company’s guidance while awaiting its promised record-level breakdown.[1]