Chainalysis Confirms Cyberattack: Unauthorized Access to Internal Tools via 'Offensive Agentic Techniques' Exposes Customer Account Data

Key facts for Chainalysis agentic breach

Detection coverage for Chainalysis agentic breach

As of 2026-11-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5046 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Bulk User Directory Enumeration via API Paging (TL-2026-5046)

Detects one authenticated identity or source paging through 30+ pages (150+ requests in 15 minutes) of user, member, account or organization endpoints. Models automated collection of the account records Chainalysis confirmed exposed: user IDs, full names, emails and organization role labels (T1213, T1119, T1087).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1213, T1119, T1087
• Data sources: web:access_combined, W3CIISLog, application API logs
• Severity: high
• Confidence: medium

Splunk SPL

index=web sourcetype=access_combined method=GET status=200 earliest=-4h
| where match(lower(uri_path),"/(api/)?(v[0-9]+/)?(users|members|accounts|provision|organizations|orgs)(/|$)")
| rex field=uri "(?i)(?:page|offset|cursor)=(?<page_marker>[^&\s]+)"
| bin _time span=15m
| stats count AS reqs dc(uri) AS distinct_uris dc(page_marker) AS pages sum(bytes) AS bytes_out by _time user clientip host
| where reqs>=150 AND pages>=30
| eval mb_out=round(bytes_out/1048576,2)
| sort - reqs
| table _time user clientip host reqs distinct_uris pages mb_out

Microsoft KQL

W3CIISLog
| where TimeGenerated > ago(4h)
| where csMethod == "GET" and scStatus == 200
| where tolower(csUriStem) matches regex @"/(api/)?(v[0-9]+/)?(users|members|accounts|provision|organizations|orgs)(/|$)"
| extend page_marker = extract(@"(?i)(?:page|offset|cursor)=([^&\s]+)", 1, csUriQuery)
| summarize reqs=count(), distinct_uris=dcount(strcat(csUriStem, csUriQuery)), pages=dcount(page_marker), bytes_out=sum(scBytes) by bin(TimeGenerated, 15m), csUserName, cIP, sSiteName
| where reqs >= 150 and pages >= 30
| extend mb_out = round(todouble(bytes_out) / 1048576, 2)
| order by reqs desc

Sigma

title: Large-Page User Directory Retrieval via API (TL-2026-5046)
id: 1b9f6d3c-7e24-4c85-a1d0-5e8f2b4c6a44
status: experimental
description: Requests to user, member, account or organization endpoints with large page-size parameters, indicating bulk harvesting of account records (user IDs, names, emails, role labels) as exposed in the Chainalysis incident. Aggregated paging detection is in the SPL/KQL variants.
references:
    - https://www.chainalysis.com/blog/security-incident-october-30/
    - https://gbhackers.com/chainalysis-confirms-cyberattack/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
    - attack.collection
    - attack.t1213
    - attack.t1119
    - attack.discovery
    - attack.t1087
logsource:
    category: webserver
detection:
    selection_path:
        c-uri|contains:
            - '/users'
            - '/members'
            - '/accounts'
            - '/provision'
            - '/organizations'
    selection_size:
        c-uri|contains:
            - 'per_page=500'
            - 'per_page=1000'
            - 'limit=500'
            - 'limit=1000'
            - 'page_size=500'
            - 'page_size=1000'
    condition: selection_path and selection_size
falsepositives:
    - Legitimate admin exports and directory sync jobs
    - SCIM provisioning connectors
level: medium

Known false positives:

• SCIM or directory sync connectors
• Admin users exporting the user list
• Analytics or BI jobs that read user tables

Tuning notes: Allowlist service accounts and provisioning connectors. Tune the endpoint regex to your user API. Lower thresholds for tools holding sensitive customer rosters. Alert on rows where user is a service identity outside its normal schedule.

• 🔒 Web Exploit Payload Patterns Against Public-Facing Apps (TL-2026-5046) · unlock with TL Creds
• 🔒 Machine-Regular Authenticated Access to Internal Tools (TL-2026-5046) · unlock with TL Creds
• 🔒 Password Reset Wave from a Single Source (TL-2026-5046) · unlock with TL Creds
• 🔒 Successful External Access to Internal Tool or Debug Endpoints (TL-2026-5046) · unlock with TL Creds
• 🔒 AI Agent and Browser Automation Clients Against Web Apps (TL-2026-5046) · unlock with TL Creds
• 🔒 Password Reset Followed by MFA Factor Change (TL-2026-5046) · unlock with TL Creds
• 🔒 Web Probing Burst Against Public-Facing Apps - Agentic Recon (TL-2026-5046) · unlock with TL Creds
• 🔒 Chainalysis Lookalike Domain Lookup - Phishing Follow-On (TL-2026-5046) · unlock with TL Creds

Indicators of compromise for Chainalysis agentic breach

As of 2026-11-02, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-5046.

How Chainalysis agentic breach works

Chainalysis, a blockchain-analytics vendor, stated in a customer email and a company blog post dated 2026-10-30 that during October 2026 it detected an external actor using "offensive agentic techniques" to gain unauthorized access to Chainalysis systems and internal tools. The company did not define the term. Independent commentary notes it may indicate autonomous or semi-autonomous AI agents performing parts of the intrusion that a human operator would normally perform (finding weaknesses, trying access, moving between systems), or it may be a loose description of a partly automated attack. This has not been confirmed by the vendor.

According to the vendor, the exposed data was limited to what it characterized as non-sensitive customer data: user IDs, full names, email addresses and organization role labels for users provisioned on the platform. Chainalysis stated it found no indication of unauthorized access to investigation content (graphs, notes, cases), transaction or query results, clear-text passwords, MFA secrets or user session tokens. The company is still determining exactly which records were accessed per organization and said it will provide customers with organization-specific breakdowns.

The vendor did not disclose the initial access vector, specific vulnerabilities or CVE identifiers. Secondary reporting (GBHackers) states the attacker exploited vulnerabilities in internal systems; the vendor says it patched vulnerabilities and hardened its systems. No threat actor has been named and no network, file or host indicators were published. Chainalysis explicitly stated the incident is unrelated to the recent cryptocurrency theft at Binance.

Response actions reported: engagement of third-party cybersecurity specialists, use of large language models for a broader security review of the platform, patching and hardening, and proactive customer notification. Customers are advised to enable two-factor authentication, watch for unexpected password-reset requests and contact account managers for MFA assistance. Chainalysis acknowledged potential phishing risk from the exposed names, emails and role labels; defenders at customer organizations (many are investigators, compliance and law-enforcement users) should treat targeted phishing and social engineering referencing Chainalysis as a likely downstream risk. The investigation is ongoing and details may change.

MITRE ATT&CK techniques by tactic:

Collection

T1119 Automated Collection; T1213 Data from Information Repositories

Initial Access

T1190 Exploit Public-Facing Application

Resource Development

T1588.007 Artificial Intelligence

Reconnaissance

T1595.002 Vulnerability Scanning

Remediation for Chainalysis agentic breach

Patches

• Vendor reports vulnerabilities were patched; no CVE or patch identifier disclosed

Immediate actions

• Enable two-factor authentication on all Chainalysis user accounts
• Treat unexpected password-reset requests and emails referencing Chainalysis as suspicious and verify out-of-band
• Alert provisioned Chainalysis users to targeted phishing risk using their exposed names, emails and role labels
• Contact your Chainalysis account manager for the organization-specific breakdown of affected records and for MFA assistance

Workarounds

• Rotate credentials and review login activity for vendor accounts if any anomalies are observed

Longer-term hardening

• Review third-party vendor access and data-sharing for analytics and compliance tools
• Monitor for AI-assisted automated reconnaissance and exploitation against internet-facing and internal tooling
• Apply phishing-resistant MFA and least-privilege role provisioning for vendor platforms

Affected and fixed versions

• Chainalysis — Chainalysis platform and internal tools (customer account records)
  Vulnerable versions: Not disclosed
  Fixed in: Vendor reports vulnerabilities patched and systems hardened

Timeline of Chainalysis agentic breach

• 2026-10-01 During October 2026 locked-ioc-6 detected an external actor using offensive agentic techniques to gain unauthorized access to its systems and internal tools (exact date not disclosed).
• 2026-10-30 locked-ioc-6 reported patching vulnerabilities, hardening systems, engaging third-party cybersecurity specialists and using large language models for a broader platform security review.
• 2026-10-30 locked-ioc-6 published its security incident statement describing exposed user IDs, full names, email addresses and organization role labels, and denying any link to the locked-ioc-7 crypto theft.
• 2026-10-30 locked-ioc-6 alerted customers by email about the incident; locked-ioc-5 published the initial disclosure.
• 2026-11-01 Secondary reporting analyzed the meaning of 'offensive agentic techniques' and noted the vendor was still determining which records per organization were accessed.
• 2026-11-02 GBHackers reported the confirmed cyberattack, stating attackers exploited vulnerabilities to access internal tools; investigation remains ongoing.

Sources cited for Chainalysis agentic breach

• Chainalysis Security Incident Statement (October 30) chainalysis.com · Vendor report · 2026-10-30
• UpGuard security report: Chainalysis upguard.com · Research · 2026-11-02
• Chainalysis Confirms Cyberattack as Hackers Exploit Vulnerabilities to Access Internal Tools gbhackers.com · News · 2026-11-02
• Chainalysis hacked: AI agent attack on customers pasqualepillitteri.it · News · 2026-11-01
• Chainalysis security incident coverage - The Paypers tag page thepaypers.com · News · 2026-10-31

More in data breach

• Binance security incident: compromised DevOps engineer laptop leads to service container access and ~$6.3 billion in unauthorized withdrawals
• Wagyu.xyz Alleged Data Leak: 38,628 Swap Orders and 10,139 IPs Claimed by WhiteArmor, Exposing Monero Metadata Correlation Risk
• Moldova Government Systems Cyberattack Exploiting Unauthenticated Services, ~750,000 ID Records Accessed (Oct 19-23, 2026)
• Covered California Phishing Incident Exposes Licensed Insurance Agent Data (PII incl. SSN/FEIN)
• DreamHost Forces Email and FTP/SFTP Password Resets Following Undisclosed Security Incident (Oct 2026)