Chainalysis breached using “offensive agentic techniques”
Blockchain analytics firm Chainalysis has suffered a cybersecurity incident that led to a data breach.
According to the company’s Friday announcement, the incident is unrelated to the recent Binance hack.
What was accessed?
In October, the company detected external attackers using “offensive agentic techniques” to gain access to Chainalysis systems and internal tools.
“Based on the evidence available to date, we have found no indication that these incidents resulted in the unauthorized access of investigation content (such as graphs, notes, or cases), transaction or query results, passwords in clear text, MFA secrets, or user session tokens,” Chainalysis stated.
However, the attackers managed to access some customer (user) IDs, full names, email addresses, and organization role labels for users provisioned on the company’s platform.
Chainalysis did not elaborate further on the offensive agentic techniques used by the attackers.
A key player in crypto crime investigations
Because blockchains like Bitcoin record every transaction publicly (but pseudonymously), Chainalysis clusters addresses, links them to real-world entities such as exchanges, darknet markets, or sanctioned groups, and flags risky flows.
The company has been involved in investigating the money flows following the massive Binance hack last week, which has been attributed to the North Korean cybercrime group TraderTraitor.
“Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit,” Chainalysis shared.
“Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds. Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence.”
Chainalysis’ response
Chainalysis sent out an email alert to impacted customers, urging them to be on the lookout for unexpected password reset requests or authentication prompts. The company also advised them to enable two-factor authentication on their accounts (if they haven’t already).
Among its customers are crypto exchanges and banks, as well as law enforcement and government agencies around the world. Unauthorized access to customers’ names and contact information puts them at heightened risk of social engineering attacks.
Third-party cybersecurity experts have been called in to help with the investigation and to review the security of Chainalysis’ platform, discover vulnerabilities and, in general, strengthen the company’s defenses.
“We are in the process of determining the records for your organization that were accessed and will provide a detailed breakdown as soon as that analysis is complete,” it told affected customers.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
