# Chainalysis Confirms Cyberattack: Unauthorized Access to Internal Tools via 'Offensive Agentic Techniques' Exposes Customer Account Data

> Chainalysis disclosed on 2026-10-30 that an external actor used "offensive agentic techniques" to gain unauthorized access to its systems and internal tools, exposing customer account records (user IDs, full names, email addresses, organization role labels). The company reports no indication that investigation content, credentials, MFA secrets or session tokens were accessed; the investigation is ongoing.

- **Published:** 2026-11-02T10:50:50Z
- **Last reviewed:** 2026-11-02T10:50:50Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5046
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5046.png
- **ID:** TL-2026-5046
- **Severity:** MEDIUM
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 7

## Description

Chainalysis, a blockchain-analytics vendor, stated in a customer email and a company blog post dated 2026-10-30 that during October 2026 it detected an external actor using "offensive agentic techniques" to gain unauthorized access to Chainalysis systems and internal tools. The company did not define the term. Independent commentary notes it may indicate autonomous or semi-autonomous AI agents performing parts of the intrusion that a human operator would normally perform (finding weaknesses, trying access, moving between systems), or it may be a loose description of a partly automated attack. This has not been confirmed by the vendor.

According to the vendor, the exposed data was limited to what it characterized as non-sensitive customer data: user IDs, full names, email addresses and organization role labels for users provisioned on the platform. Chainalysis stated it found no indication of unauthorized access to investigation content (graphs, notes, cases), transaction or query results, clear-text passwords, MFA secrets or user session tokens. The company is still determining exactly which records were accessed per organization and said it will provide customers with organization-specific breakdowns.

The vendor did not disclose the initial access vector, specific vulnerabilities or CVE identifiers. Secondary reporting (GBHackers) states the attacker exploited vulnerabilities in internal systems; the vendor says it patched vulnerabilities and hardened its systems. No threat actor has been named and no network, file or host indicators were published. Chainalysis explicitly stated the incident is unrelated to the recent cryptocurrency theft at Binance.

Response actions reported: engagement of third-party cybersecurity specialists, use of large language models for a broader security review of the platform, patching and hardening, and proactive customer notification. Customers are advised to enable two-factor authentication, watch for unexpected password-reset requests and contact account managers for MFA assistance. Chainalysis acknowledged potential phishing risk from the exposed names, emails and role labels; defenders at customer organizations (many are investigators, compliance and law-enforcement users) should treat targeted phishing and social engineering referencing Chainalysis as a likely downstream risk. The investigation is ongoing and details may change.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1588.007 Artificial Intelligence
- T1190 Exploit Public-Facing Application
- T1213 Data from Information Repositories
- T1119 Automated Collection

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Bulk User Directory Enumeration via API Paging (TL-2026-5046)** (`TL-2026-5046-SPL-002`)

Detects one authenticated identity or source paging through 30+ pages (150+ requests in 15 minutes) of user, member, account or organization endpoints. Models automated collection of the account records Chainalysis confirmed exposed: user IDs, full names, emails and organization role labels (T1213, T1119, T1087).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1213, T1119, T1087
- **Data sources:** web:access_combined, W3CIISLog, application API logs
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=web sourcetype=access_combined method=GET status=200 earliest=-4h
| where match(lower(uri_path),"/(api/)?(v[0-9]+/)?(users|members|accounts|provision|organizations|orgs)(/|$)")
| rex field=uri "(?i)(?:page|offset|cursor)=(?<page_marker>[^&\s]+)"
| bin _time span=15m
| stats count AS reqs dc(uri) AS distinct_uris dc(page_marker) AS pages sum(bytes) AS bytes_out by _time user clientip host
| where reqs>=150 AND pages>=30
| eval mb_out=round(bytes_out/1048576,2)
| sort - reqs
| table _time user clientip host reqs distinct_uris pages mb_out
```

### Microsoft KQL

```kql
W3CIISLog
| where TimeGenerated > ago(4h)
| where csMethod == "GET" and scStatus == 200
| where tolower(csUriStem) matches regex @"/(api/)?(v[0-9]+/)?(users|members|accounts|provision|organizations|orgs)(/|$)"
| extend page_marker = extract(@"(?i)(?:page|offset|cursor)=([^&\s]+)", 1, csUriQuery)
| summarize reqs=count(), distinct_uris=dcount(strcat(csUriStem, csUriQuery)), pages=dcount(page_marker), bytes_out=sum(scBytes) by bin(TimeGenerated, 15m), csUserName, cIP, sSiteName
| where reqs >= 150 and pages >= 30
| extend mb_out = round(todouble(bytes_out) / 1048576, 2)
| order by reqs desc
```

### Sigma

```yaml
title: Large-Page User Directory Retrieval via API (TL-2026-5046)
id: 1b9f6d3c-7e24-4c85-a1d0-5e8f2b4c6a44
status: experimental
description: Requests to user, member, account or organization endpoints with large page-size parameters, indicating bulk harvesting of account records (user IDs, names, emails, role labels) as exposed in the Chainalysis incident. Aggregated paging detection is in the SPL/KQL variants.
references:
    - https://www.chainalysis.com/blog/security-incident-october-30/
    - https://gbhackers.com/chainalysis-confirms-cyberattack/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
    - attack.collection
    - attack.t1213
    - attack.t1119
    - attack.discovery
    - attack.t1087
logsource:
    category: webserver
detection:
    selection_path:
        c-uri|contains:
            - '/users'
            - '/members'
            - '/accounts'
            - '/provision'
            - '/organizations'
    selection_size:
        c-uri|contains:
            - 'per_page=500'
            - 'per_page=1000'
            - 'limit=500'
            - 'limit=1000'
            - 'page_size=500'
            - 'page_size=1000'
    condition: selection_path and selection_size
falsepositives:
    - Legitimate admin exports and directory sync jobs
    - SCIM provisioning connectors
level: medium

```

**Known false positives:**

- SCIM or directory sync connectors
- Admin users exporting the user list
- Analytics or BI jobs that read user tables

**Tuning notes:** Allowlist service accounts and provisioning connectors. Tune the endpoint regex to your user API. Lower thresholds for tools holding sensitive customer rosters. Alert on rows where user is a service identity outside its normal schedule.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Web Exploit Payload Patterns Against Public-Facing Apps (TL-2026-5046) (locked: unlock with TL Creds)
- Machine-Regular Authenticated Access to Internal Tools (TL-2026-5046) (locked: unlock with TL Creds)
- Password Reset Wave from a Single Source (TL-2026-5046) (locked: unlock with TL Creds)
- Successful External Access to Internal Tool or Debug Endpoints (TL-2026-5046) (locked: unlock with TL Creds)
- AI Agent and Browser Automation Clients Against Web Apps (TL-2026-5046) (locked: unlock with TL Creds)
- Password Reset Followed by MFA Factor Change (TL-2026-5046) (locked: unlock with TL Creds)
- Web Probing Burst Against Public-Facing Apps - Agentic Recon (TL-2026-5046) (locked: unlock with TL Creds)
- Chainalysis Lookalike Domain Lookup - Phishing Follow-On (TL-2026-5046) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Chainalysis Confirms Cyberattack as Hackers Exploit Vulnerabilities to Access Internal Tools](https://gbhackers.com/chainalysis-confirms-cyberattack/)
- [Chainalysis Security Incident Statement (October 30)](https://www.chainalysis.com/blog/security-incident-october-30/)
- [Chainalysis hacked: AI agent attack on customers](https://pasqualepillitteri.it/en/news/28631/chainalysis-hacked-ai-agent-attack-customers)
- [Chainalysis security incident coverage - The Paypers tag page](https://thepaypers.com/tags/latest-news-on-chainalysis--34567)
- [UpGuard security report: Chainalysis](https://www.upguard.com/security-report/chainalysis)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5046