Chainalysis says hacker using 'offensive agentic techniques' accessed its customers' names and emails

Blockchain analytics firm Chainalysis said an unidentified hacker using "offensive agentic techniques" broke into its systems and internal tools this month and accessed some "non-sensitive" customer data, according to a notice sent to affected customers.

Chainalysis published the full text of the notice in a blog post on Friday evening. The attacker accessed "some non-sensitive customer data, such as user IDs, full names, email addresses, and organization role labels for users provisioned on our platform," the company said, pledging to send a follow-up to each client detailing which exact information was accessed. 

"Based on the evidence available to date, we have found no indication that these incidents resulted in the unauthorized access of investigation content (such as graphs, notes, or cases), transaction or query results, passwords in clear text, MFA secrets, or user session tokens," Chainalysis wrote.

Chainalysis did not say when it detected the intrusion, which was first flagged by International Cyber Digest, how many customers were affected, which specific vulnerabilities the attacker exploited, or how AI agents played a role in the breach. Chainalysis declined to answer specific follow-up questions from The Block. 

Chainalysis said it has contracted third-party cybersecurity experts and is using large language models to support a broad security review of its platform. The firm advised affected firms to turn on two-factor authentication and to be on the lookout for suspicious activities like unexpected password reset requests or authentication prompts. 

Chainalysis breach "not related" to Binance hack

Chainalysis said the incident is "not related to the recent crypto theft at Binance." Chainalysis, Elliptic and TRM have each attributed the roughly $6.3 billion Binance hack to North Korean hacking groups, which, according to Binance, managed to compromise an engineer's laptop and access a service container. The exchange's co-CEO Richard Teng said the breach was more complex than the compromise of a single employee's permissions, though. 

On Ethereum, the attacker used EIP-7702 to turn a Binance hot wallet into a sweeper, The Block previously reported. The sweeper contract was only around 130 lines, Immunefi Vice President Simone Imbrescia said in a statement shared with The Block. "The hard part sometimes is getting access to a system powerful enough to make very simple code devastating," Imbrescia said.

Chainalysis, which puts the theft at $6.4 billion, has continued to track the stolen funds. On Friday, the firm said it was seeing "never-seen-before laundering patterns," with thousands of transactions in a short period suggesting the attackers were using automation to obscure the trail. Rather than simply forwarding funds to new addresses, the attackers repeatedly circulated the stolen crypto among addresses, often sending funds back to addresses used earlier in the sequence, the firm said, sharing a diagram showing the funds' movements. 

On Saturday, Chainalysis said the exploiters have used DeFi lending protocols on the Tron network to stay ahead of stablecoin freezes since the early hours of the attack. The hackers swapped Tron's native TRX token for various stablecoins and deposited them in a lending protocol, identified by onchain analysts Specter and Ian Unsworth as JustLend, in exchange for receipt tokens, which cannot be frozen by stablecoin issuers. The attackers then moved those receipts to clean wallets, redeemed them for stablecoins and bridged the funds off Tron, swapping them for ETH on the other side, according to the firm.

"Now the exploiter is free of worry of a freeze," the firm wrote. Chainalysis' Saturday thread noted that around $2.8 billion in stablecoins have already been frozen by stablecoin firms such as Circle and Tether. "Of course, exchanging stablecoins for ETH does not make the hackers bulletproof," Chainalysis added.