Chainalysis, the firm that traces crypto theft, says it was hacked using AI agents

The company that helps track stolen cryptocurrency has had to investigate its own breach. On October 30, Chainalysis published a post and emailed affected customers: an outside actor got into its systems and internal tools. To describe the method, it uses an unusual phrase: "offensive agentic techniques."

The term points to AI agents, programs that can chain actions together on their own. The company does not define it. It says it detected the intrusion "this month," without giving a date, and has since been working to fix vulnerabilities and harden its systems. BleepingComputer, which reported the story on October 31, obtained confirmation from a spokesperson.

What data was accessed?

According to Chainalysis, data it considers "non-sensitive" was accessed: user IDs, full names, email addresses and people's roles within their organizations. The company has not finished determining which records from each customer organization were affected.

It says, however, that "at this stage of the investigation" it has found no evidence of access to investigation content, query or transaction results, plaintext passwords, two-factor authentication secrets or session tokens. It also states that the incident has no connection to the recent theft suffered by Binance.

AI agents, but which ones?

That is the big unknown. Chainalysis does not say which vulnerabilities were exploited, which internal tools were reached, or what allows it to speak of agents. BleepingComputer notes that it is unclear whether the attackers used an already known offensive tool, such as ARTEX, or agents built for the occasion. According to Microsoft, ARTEX was used in the compromise of ConnectWise's backup service, which we detailed in our article on the 162 Microsoft 365 environments opened to hackers.

No attacker is named. For its defense, Chainalysis says it is working with outside experts and is itself using large language models to review its platform.

What to do if you are a customer

The exposed data is enough to craft convincing deceptive messages: a name, a work address and a job title. Chainalysis recommends:

• enabling two-factor authentication, through your account manager if your organization has not done so yet;
• being wary of password reset requests and unexpected authentication requests;
• according to BleepingComputer, staying alert to scammers posing as Chainalysis, notably with fake fund-recovery or recruitment offers.

The company promises to keep its customers informed as the investigation progresses. If it ever details the real role of AI agents in the attack, it will be one of the first documented accounts of such an intrusion told by the victim itself.