Blockchain analytics firm Chainalysis has confirmed that an unidentified hacker using “offensive agentic techniques” gained access to its internal systems and tools this month, exposing some non-sensitive customer data. The company published the full text of its customer notice in a blog post on Friday evening.
According to Chainalysis, the attacker accessed user IDs, full names, email addresses, and organization role labels for users provisioned on its platform. The firm said it found no indication that the incident resulted in unauthorized access to investigation content such as graphs, notes, or cases, transaction or query results, plaintext passwords, MFA secrets, or user session tokens.
Chainalysis did not disclose when the intrusion was detected, how many customers were affected, which vulnerabilities were exploited, or how AI agents were involved. The company declined to answer specific follow-up questions from The Block. It has contracted third-party cybersecurity experts and is using large language models to support a broad security review, and it advised affected firms to enable two-factor authentication and monitor for suspicious password reset requests or authentication prompts.
The breach was first flagged by International Cyber Digest and follows a wave of security incidents across the crypto industry, including a data breach at South Korea’s Bithumb, a security incident involving Polymarket, and the exploitation of Binance. Chainalysis said its incident is “not related” to the recent Binance crypto theft.
Chainalysis, Elliptic and TRM have attributed the roughly $6.3 billion Binance hack to North Korean hacking groups. Chainalysis puts the theft at about $6.4 billion and has continued to track the stolen funds. On Ethereum, the attacker used EIP-7702 to turn a Binance hot wallet into a sweeper contract of only about 130 lines. On Friday, Chainalysis reported “never-seen-before laundering patterns”, with thousands of transactions suggesting automated movement of stolen funds across old and new addresses.
On Saturday, the firm said the exploiters used DeFi lending protocols on the Tron network to stay ahead of stablecoin freezes. The hackers swapped TRX for various stablecoins and deposited them into JustLend for receipt tokens that cannot be frozen by stablecoin issuers. Those receipts were moved to clean wallets, redeemed for stablecoins, bridged off Tron, and swapped for ETH. Chainalysis noted that around $2.8 billion in stablecoins have already been frozen by firms such as Circle and Tether, adding that exchanging stablecoins for ETH does not make the hackers bulletproof.
