Blockchain analytics firm Chainalysis says hackers obtained sensitive personal data — including names, usernames, password hashes and live session tokens — for every one of its customers, following a breach the company has described as an "ongoing multifront cyberattack." Chainalysis's client list reportedly includes government agencies such as the FBI, US Immigration and Customs Enforcement and the US Air Force, alongside private firms including Microsoft, Coinbase and Barclays.
The company first disclosed a cybersecurity incident last Friday, saying an "external actor used AI agent-assisted offensive techniques" to gain unauthorized access to its internal tools in October, in an attack it compared to breaches of other platforms the same month. At the time, Chainalysis told affected customers that only "non-sensitive" information — user IDs, names, emails and organization role labels — had been accessed.
A bigger breach than first disclosed
By Wednesday, the company's account had changed. Chainalysis said part of the attack involved an "on-path attack" — also known as an adversary-in-the-middle attack, in which a hacker intercepts traffic passing between two parties — that exposed a subset of customer passwords. Later that day, the company said an internal investigation, completed two days earlier, had found that names, usernames, password hashes and live tokens "for all Chainalysis users were exposed to a malicious actor."
Chainalysis responded by taking down its login page and its "know-your-transaction" monitoring service, along with its Reactor and Data Solutions tools, and has since begun restoring access in phases. It is asking customers to submit trusted IP addresses for an access allow-list and to prepare for a mandatory credential reset once service resumes. The company says it has found no evidence so far that investigation data or its blockchain attribution records were accessed or altered.
Several questions remain unresolved: Chainalysis has not said where the on-path compromise occurred, whether the intercepted traffic was encrypted, or how its AI agents were used in the breach. The company also has not explained why it waited until Wednesday to disclose a full-customer-base exposure that its own investigation had identified two days earlier. A company spokesperson said Chainalysis was not commenting beyond its public statements.