# Chainalysis breach via agentic on-path (AitM) attack exposes user credentials and live authentication tokens

> Chainalysis disclosed on 2026-10-30 that an external actor using 'offensive agentic techniques' gained unauthorized access to its systems and internal tools. A November 4 update states usernames, password hashes and live tokens were exposed, and that an on-path attack exposed customer passwords during one phase; most products (Reactor, Data Solutions, KYT, Address Screening) were taken offline.

- **Published:** 2026-11-05T19:33:09Z
- **Last reviewed:** 2026-11-05T19:33:09Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5339
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5339.png
- **ID:** TL-2026-5339
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 7

## Description

On 2026-10-30 Chainalysis, a blockchain analytics vendor whose customers include law enforcement, government agencies, cryptocurrency exchanges and financial institutions, publicly disclosed a security incident in which an unidentified external actor used what the company calls 'offensive agentic techniques' (AI-driven attack automation) to gain unauthorized access to its systems and internal tools. The company described the activity as an 'ongoing multifront cyberattack'. It is not stated which agentic frameworks or custom agents were used, or how much of the operation was automated versus human-directed; secondary reporting only speculates about existing agentic offensive frameworks versus custom-built agents.

The scope of exposed data grew between disclosures. The initial notice (and secondary reporting from 2026-10-31 to 2026-11-02) listed user IDs, full names, email addresses and organization role labels, and stated there was no evidence of access to investigation content, clear-text passwords, MFA secrets or user session tokens. The updated notice (most recent update 2026-11-04 11:00 PM EST) states that names, usernames, password hashes and live tokens for all Chainalysis users were accessed, and that an 'on-path attack' (attacker-in-the-middle) exposed customer passwords during one phase of the intrusion. The same notice continues to state there is no indication of unauthorized access to investigation content, clear-text passwords, MFA secrets or user session tokens; the notice wording on tokens versus session tokens is therefore not fully reconciled in the public sources, and The Register (2026-11-05) reports the exposure as live authentication tokens. Chainalysis also reported abnormal activity in its transaction screening product and said it saw no evidence that investigations data was accessed or that Chainalysis attribution data was manipulated.

Affected services taken offline: Reactor, Data Solutions, Chain (Beta), KYT, Address Screening and the login page. Restoration of KYT and Address Screening began on 2026-11-05. Customers must reset passwords and rotate API keys before regaining access; The Register also reports IP allowlisting and enhanced authentication requirements. Chainalysis engaged third-party cybersecurity experts, is using large language models in a broader security review, and said the incident is unrelated to the Binance theft reported the prior week. The company said the attack resembles activity against many other tech platforms in recent weeks. No threat actor, malware, vulnerability/CVE or network indicators (IPs, domains, hashes) have been published; the earlier access vector is undisclosed.

## MITRE ATT&CK

- T1588.007 Artificial Intelligence
- T1078 Valid Accounts
- T1557 Adversary-in-the-Middle
- T1528 Steal Application Access Token
- T1213 Data from Information Repositories

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Chainalysis Breach — Exposed Credential/Token Reuse: Multi-IP/ASN Chainalysis SSO Sessions (Okta)** (`TL-2026-5339-SPL-001`)

TL-2026-5339 (Chainalysis breach, agentic on-path/AitM attack): usernames, password hashes and live authentication tokens were exposed, and an on-path phase captured customer passwords. Detects one identity completing successful Chainalysis SSO or session starts from 3+ IPs spanning 2+ ASNs within 24h, the behavioural signature of stolen credentials or tokens being replayed from attacker infrastructure (T1528 Steal Application Access Token, T1078 Valid Accounts). Community/OSINT corroboration for this threat is empty, so the logic is behaviour-first rather than IOC-based.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1528, T1550.001, T1078
- **Data sources:** okta:OktaIM2:log, azure_ad:SigninLogs
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=okta sourcetype="OktaIM2:log" eventType IN ("user.authentication.sso","user.session.start") outcome.result=SUCCESS "Chainalysis" earliest=-24h
| eval user='actor.alternateId', ip='client.ipAddress', ua='client.userAgent.rawUserAgent', asn='securityContext.asNumber'
| stats dc(ip) AS ip_count dc(asn) AS asn_count dc(ua) AS ua_count values(ip) AS src_ips values(ua) AS user_agents min(_time) AS first_seen max(_time) AS last_seen by user
| where ip_count>=3 AND asn_count>=2
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType == 0
| where AppDisplayName has "Chainalysis" or ResourceDisplayName has "Chainalysis"
| summarize IPCount = dcount(IPAddress), ASNCount = dcount(AutonomousSystemNumber), UACount = dcount(UserAgent), SourceIPs = make_set(IPAddress, 10), UserAgents = make_set(UserAgent, 10), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by UserPrincipalName
| where IPCount >= 3 and ASNCount >= 2
| project UserPrincipalName, IPCount, ASNCount, UACount, SourceIPs, UserAgents, FirstSeen, LastSeen
```

### Sigma

```yaml
title: Chainalysis SSO Success Event
name: chainalysis_sso_success
id: 7c1e9a52-5339-4d01-9a3b-1b0c2d3e4f01
status: experimental
description: Successful Okta SSO or session start involving a Chainalysis application. Base rule for the multi-IP replay correlation below.
references:
    - https://www.chainalysis.com/blog/security-incident-october-30/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
    - attack.credential-access
    - attack.t1528
logsource:
    product: okta
    service: okta
detection:
    selection:
        eventtype:
            - user.authentication.sso
            - user.session.start
        outcome.result: SUCCESS
        target.displayName|contains: Chainalysis
    condition: selection
falsepositives:
    - Normal Chainalysis user logins (this rule is only a correlation building block)
level: informational
---
title: Chainalysis SSO Sessions From Multiple Source IPs (Possible Token or Credential Replay)
id: 7c1e9a52-5339-4d01-9a3b-1b0c2d3e4f02
status: experimental
description: One Okta identity authenticated to a Chainalysis application from 3 or more distinct IPs within 24 hours, consistent with replay of credentials or live tokens exposed in the TL-2026-5339 Chainalysis breach.
references:
    - https://www.chainalysis.com/blog/security-incident-october-30/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
    - attack.credential-access
    - attack.t1528
    - attack.defense-evasion
    - attack.t1550.001
    - attack.initial-access
    - attack.t1078
correlation:
    type: value_count
    rules:
        - chainalysis_sso_success
    group-by:
        - actor.alternateId
    timespan: 24h
    condition:
        gte: 3
        field: client.ipAddress
falsepositives:
    - Users roaming between corporate VPN, home and mobile networks
    - Shared accounts fronted by multiple egress IPs
level: high

```

**Known false positives:**

- Travelling users switching between corporate VPN, home broadband and mobile carrier networks
- Shared service accounts or SSO brokers that egress through multiple IPs

**Tuning notes:** Raise ip_count/asn_count for roaming users, exclude corporate VPN/egress ASNs and known service accounts with a lookup, and enrich with Okta ThreatInsight or Entra risk level to prioritise. If the application label differs in your tenant, replace the free-text Chainalysis term with the exact app name. Restrict to sessions after 2026-10-30 when hunting retroactively.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Chainalysis Breach AitM — Interactive Sign-in Followed by Token Replay From Different IP/ASN (Entra ID) (locked: unlock with TL Creds)
- Chainalysis Breach Follow-on — Password Reset Plus Security Info Change Within One Hour (Entra ID) (locked: unlock with TL Creds)
- Chainalysis Breach — Scripting Runtimes Connecting to Chainalysis Hosts From Endpoints (locked: unlock with TL Creds)
- Chainalysis Breach AitM — DNS Lookups for Chainalysis Lookalike Domains (locked: unlock with TL Creds)
- Chainalysis Breach — Okta API Token Created or Enabled (locked: unlock with TL Creds)
- Chainalysis Breach — Credential Stuffing With Exposed Credentials: Many Failed Logins Then Success From One IP (Entra ID) (locked: unlock with TL Creds)
- Chainalysis Breach — MFA Push Storm and Password/Factor Reset Burst (Okta) (locked: unlock with TL Creds)
- Chainalysis Breach — Automated High-Rate Chainalysis API/Web Harvesting via Scripted Clients (Web Proxy) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Chainalysis Security Incident Notice (updated 2026-11-04)](https://www.chainalysis.com/blog/security-incident-october-30/)
- [The Register: October crypto-tracker hack: Access cracked, law enforcement tokens packed](https://www.theregister.com/cyber-crime/2026/11/05/october-crypto-tracker-hack-access-cracked-law-enforcement-tokens-packed/5307852)
- [BleepingComputer: Chainalysis discloses data breach from offensive agentic techniques](https://www.bleepingcomputer.com/news/security/chainalysis-discloses-data-breach-from-offensive-agentic-techniques/)
- [Infosecurity Magazine: Chainalysis Warns Customers After 'Offensive Agentic' Security Incident](https://www.infosecurity-magazine.com/news/chainalysis-customers-offensive/)
- [aicybr: Chainalysis October 2026 Breach: Agentic Intrusion, Exposed Data and Customer Response](https://aicybr.com/blog/chainalysis-october-2026-agentic-intrusion-customer-data-response)
- [Help Net Security: Chainalysis breached using 'offensive agentic techniques'](https://www.helpnetsecurity.com/?p=389930)
- [Security Affairs: Chainalysis Investigates Security Incident Involving AI-Driven Attack Techniques](https://securityaffairs.com/?p=202241)
- [Unchained: Chainalysis says agentic attack reached user records with no sign yet of case files](https://unchainedcrypto.com/chainalysis-says-agentic-attack-reached-user-records-with-no-sign-yet-of-case-files)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5339