Chainalysis says an external actor using offensive agentic techniques got into its systems and internal tools this month and accessed some customer user IDs, full names, email addresses and organisation role labels; it found no sign investigation content, passwords, MFA secrets or session tokens were accessed
Blockchain analytics firm Chainalysis says in a security incident post dated 30 October 2026 that it was recently the target of a cybersecurity incident, similar to many other tech platforms in recent weeks.
In the text of the email it sent to impacted customers, which it publishes in the post, Chainalysis says that this month it detected an external actor using offensive agentic techniques to gain unauthorised access to Chainalysis systems and internal tools, and that its teams have been working to investigate the activity, patch vulnerabilities and harden its systems.
It says some non-sensitive customer data, such as user IDs, full names, email addresses and organisation role labels for users provisioned on its platform, was accessed, and that it is working out which records were accessed for each organisation.
It says it has found no indication that investigation content (such as graphs, notes or cases), transaction or query results, passwords in clear text, MFA secrets or user session tokens were accessed.
Chainalysis says it has engaged third-party cybersecurity experts, has proactively notified all of its customers (some had been notified earlier), and that the incident is not related to the recent crypto theft at Binance.
It has not said when the access began, how the attacker got in, or how many users are affected. (source: Chainalysis)
- Product
- Chainalysis platform (customer user accounts)
- Versions
- n/a — data breach
- Exploited in Australia?
- unknown
- Patch to
- Chainalysis users: be very wary of unexpected password reset requests or authentication prompts, and turn on two-factor authentication if your organisation has not already (Chainalysis advice; your account manager can help). Expect phishing that uses your name, email address and role.
