Blockchain analysis firm Chainalysis confirmed that hackers stole credentials and tokens for all users in a multifront cyberattack involving AI agents. The breach exposed sensitive personal information, including names, usernames, password hashes, and live tokens, according to the company.
The incident represents a significant compromise for the firm, which provides tools to track cryptocurrency transactions for high-profile clients. Public records and company disclosures have linked Chainalysis to government agencies such as the FBI, US Immigration and Customs Enforcement, and the US Air Force. Private sector clients include Microsoft, Coinbase, and Barclays.
AI-Assisted Attack Vectors
Chainalysis first reported a cybersecurity incident in October. The company stated that an external actor used AI agent-assisted offensive techniques to gain unauthorized access to its systems and internal tools. This method mirrors attacks seen on other platforms during the same period.
In an initial notification to customers, the company described the accessed data as “non-sensitive,” listing user IDs, full names, email addresses, and organization role labels. The firm later revised this assessment as the scope of the intrusion became clearer.
A subsequent update revealed that the attack also included an on-path component. Also known as an adversary-in-the-middle attack, this technique involves a hacker intercepting traffic between two parties by compromising infrastructure. Chainalysis identified and fixed the vector for this specific attack method but has not disclosed where the infrastructure compromise occurred or whether the intercepted data was TLS encrypted.
Mandatory Credential Rotation
On Monday, investigators discovered that certain customer information, including names, usernames, password hashes, and live tokens for all Chainalysis users, had been exposed. The company detected abnormal activity and responded by taking down its login page and its Know Your Transaction (KYT) service, which monitors threats to cryptocurrency holdings in real time.
Access to the Reactor and Data Solutions services was also removed. By Friday, Chainalysis began phasing in customer access to KYT and Address Screening. The firm asked customers to submit trusted IP addresses for allow listing and to prepare for mandatory credential rotation once access is restored.
The company stated that its investigation has found no evidence that investigation data was accessed or that Chainalysis attribution data was manipulated. However, several questions remain unanswered. The source of the infrastructure used for the on-path attack is still unknown. It is unclear how useful the intercepted information would be without the ability to decrypt the monitored traffic, which would suggest broader control of the company’s infrastructure.
Chainalysis also did not explain why it waited until Wednesday to disclose the full extent of the data theft, given that the exposure was discovered on Monday. The firm provided no details about the specific AI agents used in the attack or their operational mechanics. A representative declined to comment beyond the official blog posts.
Source: Ars Technica
