Chainalysis breach via agentic on-path (AitM) attack exposes user credentials and live authentication tokens

Key facts for Chainalysis on-path token breach

Detection coverage for Chainalysis on-path token breach

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5339 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Chainalysis Breach — Exposed Credential/Token Reuse: Multi-IP/ASN Chainalysis SSO Sessions (Okta)

TL-2026-5339 (Chainalysis breach, agentic on-path/AitM attack): usernames, password hashes and live authentication tokens were exposed, and an on-path phase captured customer passwords. Detects one identity completing successful Chainalysis SSO or session starts from 3+ IPs spanning 2+ ASNs within 24h, the behavioural signature of stolen credentials or tokens being replayed from attacker infrastructure (T1528 Steal Application Access Token, T1078 Valid Accounts). Community/OSINT corroboration for this threat is empty, so the logic is behaviour-first rather than IOC-based.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1528, T1550.001, T1078
• Data sources: okta:OktaIM2:log, azure_ad:SigninLogs
• Severity: high
• Confidence: medium

Splunk SPL

index=okta sourcetype="OktaIM2:log" eventType IN ("user.authentication.sso","user.session.start") outcome.result=SUCCESS "Chainalysis" earliest=-24h
| eval user='actor.alternateId', ip='client.ipAddress', ua='client.userAgent.rawUserAgent', asn='securityContext.asNumber'
| stats dc(ip) AS ip_count dc(asn) AS asn_count dc(ua) AS ua_count values(ip) AS src_ips values(ua) AS user_agents min(_time) AS first_seen max(_time) AS last_seen by user
| where ip_count>=3 AND asn_count>=2
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType == 0
| where AppDisplayName has "Chainalysis" or ResourceDisplayName has "Chainalysis"
| summarize IPCount = dcount(IPAddress), ASNCount = dcount(AutonomousSystemNumber), UACount = dcount(UserAgent), SourceIPs = make_set(IPAddress, 10), UserAgents = make_set(UserAgent, 10), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by UserPrincipalName
| where IPCount >= 3 and ASNCount >= 2
| project UserPrincipalName, IPCount, ASNCount, UACount, SourceIPs, UserAgents, FirstSeen, LastSeen

Sigma

title: Chainalysis SSO Success Event
name: chainalysis_sso_success
id: 7c1e9a52-5339-4d01-9a3b-1b0c2d3e4f01
status: experimental
description: Successful Okta SSO or session start involving a Chainalysis application. Base rule for the multi-IP replay correlation below.
references:
    - https://www.chainalysis.com/blog/security-incident-october-30/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
    - attack.credential-access
    - attack.t1528
logsource:
    product: okta
    service: okta
detection:
    selection:
        eventtype:
            - user.authentication.sso
            - user.session.start
        outcome.result: SUCCESS
        target.displayName|contains: Chainalysis
    condition: selection
falsepositives:
    - Normal Chainalysis user logins (this rule is only a correlation building block)
level: informational
---
title: Chainalysis SSO Sessions From Multiple Source IPs (Possible Token or Credential Replay)
id: 7c1e9a52-5339-4d01-9a3b-1b0c2d3e4f02
status: experimental
description: One Okta identity authenticated to a Chainalysis application from 3 or more distinct IPs within 24 hours, consistent with replay of credentials or live tokens exposed in the TL-2026-5339 Chainalysis breach.
references:
    - https://www.chainalysis.com/blog/security-incident-october-30/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
    - attack.credential-access
    - attack.t1528
    - attack.defense-evasion
    - attack.t1550.001
    - attack.initial-access
    - attack.t1078
correlation:
    type: value_count
    rules:
        - chainalysis_sso_success
    group-by:
        - actor.alternateId
    timespan: 24h
    condition:
        gte: 3
        field: client.ipAddress
falsepositives:
    - Users roaming between corporate VPN, home and mobile networks
    - Shared accounts fronted by multiple egress IPs
level: high

Known false positives:

• Travelling users switching between corporate VPN, home broadband and mobile carrier networks
• Shared service accounts or SSO brokers that egress through multiple IPs

Tuning notes: Raise ip_count/asn_count for roaming users, exclude corporate VPN/egress ASNs and known service accounts with a lookup, and enrich with Okta ThreatInsight or Entra risk level to prioritise. If the application label differs in your tenant, replace the free-text Chainalysis term with the exact app name. Restrict to sessions after 2026-10-30 when hunting retroactively.

• 🔒 Chainalysis Breach AitM — Interactive Sign-in Followed by Token Replay From Different IP/ASN (Entra ID) · unlock with TL Creds
• 🔒 Chainalysis Breach Follow-on — Password Reset Plus Security Info Change Within One Hour (Entra ID) · unlock with TL Creds
• 🔒 Chainalysis Breach — Scripting Runtimes Connecting to Chainalysis Hosts From Endpoints · unlock with TL Creds
• 🔒 Chainalysis Breach AitM — DNS Lookups for Chainalysis Lookalike Domains · unlock with TL Creds
• 🔒 Chainalysis Breach — Okta API Token Created or Enabled · unlock with TL Creds
• 🔒 Chainalysis Breach — Credential Stuffing With Exposed Credentials: Many Failed Logins Then Success From One IP (Entra ID) · unlock with TL Creds
• 🔒 Chainalysis Breach — MFA Push Storm and Password/Factor Reset Burst (Okta) · unlock with TL Creds
• 🔒 Chainalysis Breach — Automated High-Rate Chainalysis API/Web Harvesting via Scripted Clients (Web Proxy) · unlock with TL Creds

Indicators of compromise for Chainalysis on-path token breach

As of 2026-11-05, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-5339.

How Chainalysis on-path token breach works

On 2026-10-30 Chainalysis, a blockchain analytics vendor whose customers include law enforcement, government agencies, cryptocurrency exchanges and financial institutions, publicly disclosed a security incident in which an unidentified external actor used what the company calls 'offensive agentic techniques' (AI-driven attack automation) to gain unauthorized access to its systems and internal tools. The company described the activity as an 'ongoing multifront cyberattack'. It is not stated which agentic frameworks or custom agents were used, or how much of the operation was automated versus human-directed; secondary reporting only speculates about existing agentic offensive frameworks versus custom-built agents.

The scope of exposed data grew between disclosures. The initial notice (and secondary reporting from 2026-10-31 to 2026-11-02) listed user IDs, full names, email addresses and organization role labels, and stated there was no evidence of access to investigation content, clear-text passwords, MFA secrets or user session tokens. The updated notice (most recent update 2026-11-04 11:00 PM EST) states that names, usernames, password hashes and live tokens for all Chainalysis users were accessed, and that an 'on-path attack' (attacker-in-the-middle) exposed customer passwords during one phase of the intrusion. The same notice continues to state there is no indication of unauthorized access to investigation content, clear-text passwords, MFA secrets or user session tokens; the notice wording on tokens versus session tokens is therefore not fully reconciled in the public sources, and The Register (2026-11-05) reports the exposure as live authentication tokens. Chainalysis also reported abnormal activity in its transaction screening product and said it saw no evidence that investigations data was accessed or that Chainalysis attribution data was manipulated.

Affected services taken offline: Reactor, Data Solutions, Chain (Beta), KYT, Address Screening and the login page. Restoration of KYT and Address Screening began on 2026-11-05. Customers must reset passwords and rotate API keys before regaining access; The Register also reports IP allowlisting and enhanced authentication requirements. Chainalysis engaged third-party cybersecurity experts, is using large language models in a broader security review, and said the incident is unrelated to the Binance theft reported the prior week. The company said the attack resembles activity against many other tech platforms in recent weeks. No threat actor, malware, vulnerability/CVE or network indicators (IPs, domains, hashes) have been published; the earlier access vector is undisclosed.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts

Collection

T1213 Data from Information Repositories

Credential Access

T1528 Steal Application Access Token; T1557 Adversary-in-the-Middle

Resource Development

T1588.007 Artificial Intelligence

Remediation for Chainalysis on-path token breach

Immediate actions

• Force password resets for all Chainalysis platform users before restoring access
• Rotate all Chainalysis API keys
• Enable two-factor authentication on Chainalysis accounts
• Monitor for unexpected password reset requests and unsolicited authentication prompts
• Treat messages impersonating Chainalysis as suspicious (phishing risk from exposed names, emails and roles)

Workarounds

• Keep affected products offline or restricted until hardening and credential rotation are complete (vendor action)

Longer-term hardening

• Restrict platform and API access with IP allowlists
• Prefer phishing-resistant MFA and short-lived, sender-constrained tokens to limit on-path token/password capture
• Alert on anomalous API and transaction-screening activity and on token reuse from new IPs or user agents
• Use LLM-assisted defensive review and rate/behavior-based detection for automated multi-step intrusion activity

Affected and fixed versions

• Chainalysis — Reactor
  Vulnerable versions: SaaS - as of 2026-10-30
• Chainalysis — Data Solutions
  Vulnerable versions: SaaS - as of 2026-10-30
• Chainalysis — KYT
  Vulnerable versions: SaaS - as of 2026-10-30
  Fixed in: Restoration began 2026-11-05
• Chainalysis — Address Screening
  Vulnerable versions: SaaS - as of 2026-10-30
  Fixed in: Restoration began 2026-11-05
• Chainalysis — Chain (Beta) and platform login page
  Vulnerable versions: SaaS - as of 2026-10-30

Timeline of Chainalysis on-path token breach

• 2026-10-30 locked-ioc-5 detects unauthorized access by an external actor using offensive agentic techniques and publishes its initial security incident notice; suspicious activity noted in a transaction screening product.
• 2026-10-31 BleepingComputer and other outlets report the breach; initial scope limited to user IDs, full names, email addresses and organization role labels.
• 2026-11-02 Infosecurity Magazine reports customer guidance: enable 2FA, watch for unexpected password reset requests and authentication prompts, beware impersonation scams.
• 2026-11-04 locked-ioc-5 updates its notice (11:00 PM EST): names, usernames, password hashes and live tokens for all users were accessed; an on-path attack exposed customer passwords during one phase of the intrusion.
• 2026-11-05 Restoration of locked-ioc-7 and locked-ioc-2 begins; The Register reports the expanded compromise including law enforcement customers' tokens.
• 2026-11-05 locked-ioc-6, locked-ioc-3, locked-ioc-4, locked-ioc-7, locked-ioc-2 and the login page remain offline; users must reset passwords and rotate API keys before regaining access.

Sources cited for Chainalysis on-path token breach

• Chainalysis Security Incident Notice (updated 2026-11-04) chainalysis.com · Vendor report · 2026-10-30
• aicybr: Chainalysis October 2026 Breach: Agentic Intrusion, Exposed Data and Customer Response aicybr.com · Blog · 2026-11-01
• The Register: October crypto-tracker hack: Access cracked, law enforcement tokens packed The Register · News · 2026-11-05
• BleepingComputer: Chainalysis discloses data breach from offensive agentic techniques BleepingComputer · News · 2026-10-31
• Infosecurity Magazine: Chainalysis Warns Customers After 'Offensive Agentic' Security Incident infosecurity-magazine.com · News · 2026-11-02
• Help Net Security: Chainalysis breached using 'offensive agentic techniques' Help Net Security · News · 2026-11-02
• Security Affairs: Chainalysis Investigates Security Incident Involving AI-Driven Attack Techniques securityaffairs.com · News · 2026-11-02
• Unchained: Chainalysis says agentic attack reached user records with no sign yet of case files unchainedcrypto.com · News · 2026-10-31

More in data breach

• DreamHost Data Breach via Third-Party File Manager Flaw Exposes FTP/SFTP and Webmail Credentials
• WorkOS Internal Sales App Breached by Attacker Using ARTEX AI Offensive Framework
• Frontline Education Data Breach via Third-Party Software Vulnerability Impacts Over 1.3 Million People
• Chainalysis Confirms Cyberattack: Unauthorized Access to Internal Tools via 'Offensive Agentic Techniques' Exposes Customer Account Data
• Binance security incident: compromised DevOps engineer laptop leads to service container access and ~$6.3 billion in unauthorized withdrawals