---
title: Chainalysis discloses an intrusion this month by an attacker using "offensive agentic techniques"; customer user IDs, names, emails and role labels were accessed, investigation data not seen accessed | ctxsec
url: https://ctxsec.com/items/chainalysis-security-incident-agentic-intrusion-customer-user-data
description: ""
status: "official (Chainalysis blog and customer email, Oct 30); investigation ongoing"
published: 2026-10-30
---

> 

[← Cybersecurity News](/news) · [markdown](/items/chainalysis-security-incident-agentic-intrusion-customer-user-data.md)

official (Chainalysis blog and customer email, Oct 30); investigation ongoing

2026-10-30

### Chainalysis discloses an intrusion this month by an attacker using "offensive agentic techniques"; customer user IDs, names, emails and role labels were accessed, investigation data not seen accessed

Blockchain analytics firm **Chainalysis** published the email it sent to affected customers. It says it detected an external actor this month using **"offensive agentic techniques"** to get unauthorized access to Chainalysis systems and internal tools. Its teams have been investigating, patching the exploited vulnerabilities and hardening systems.

- **Accessed:** "non-sensitive" customer data for users provisioned on the platform: **user IDs, full names, email addresses and organization role labels**. Chainalysis is still working out which records were accessed for each customer organization.
- **Not seen accessed (so far):** investigation content (graphs, notes, cases), transaction or query results, cleartext passwords, MFA secrets or user session tokens.
- **Not related to Binance:** Chainalysis says the incident is unrelated to the Binance theft it is helping trace.
- **Not disclosed:** which vulnerabilities were exploited, when exactly the intrusion began, and what the "agentic" techniques involved. Chainalysis has engaged outside responders and says it is using LLMs in a broader platform security review.

**Do now (Chainalysis users):** expect targeted phishing that uses your name, role and organization; be wary of unexpected password-reset or authentication prompts, and turn on two-factor authentication if your organization has not.

Sources: [Chainalysis: Security Incident Information (Oct 30, includes full customer email)](https://www.chainalysis.com/blog/security-incident-october-30/) · [International Cyber Digest on X: first report of the customer email](https://x.com/IntCyberDigest/status/2116257776045281620)