Your next attacker never sleeps: Chainalysis confirms a breach by AI agents, and what it reveals about your own agents

What happened

Chainalysis is an American company founded in 2014 and headquartered in New York. Its software analyses public blockchain ledgers to trace cryptocurrency transactions, for compliance and investigation purposes. Its customers are banks and brokers, as well as investigative authorities such as the FBI, the DEA, IRS Criminal Investigation and the UK's National Crime Agency, according to its Wikipedia entry. It helped US authorities recover more than one billion dollars in cryptocurrency in the Silk Road case in 2020, and attribute several 2021 thefts to North Korea's Lazarus Group. In other words, a company whose business is finding other people's traces. On Friday 30 October 2026, the company published the notice sent to its customers: during the month, it detected an external actor who, in its words, used "offensive agentic techniques" to gain unauthorised access to Chainalysis systems and internal tools.

The attacker read what Chainalysis describes as "non-sensitive" customer data: user IDs, full names, email addresses and organisation role labels. The company says it is still determining, organisation by organisation, which records were accessed, and that it will send each customer the details that concern it. It adds that the incident is unrelated to the recent crypto theft at Binance.

What is established, and what is not

Established by Chainalysis. Unauthorised access to its systems and internal tools in October. The reading of user IDs, names, email addresses and roles. The attacker's use of techniques based on AI agents, which the company places within "an industry-wide rise in AI-driven cyberattacks". The engagement of third-party experts, the patching of vulnerabilities and hardening of systems, and a broader review of its platform, for which Chainalysis says it is using large language models.

Not established, as of now. Access to investigation content (graphs, notes, cases), transaction or query results, clear-text passwords, multi-factor secrets or session tokens: Chainalysis writes that it has "no indication" of this based on the evidence available to date, which is not a final certainty.

Not disclosed. How the agents were used, which vulnerabilities were exploited, the exact date of detection and the number of customers affected. Asked by The Block, the company did not answer these questions.

Why this is a leadership issue

An AI agent cuts both ways. The automation that runs your processes also runs intrusions, without pause, at a marginal cost close to zero. What this kind of attack looks for is what your own agents use: service accounts, exposed internal tools, permissions granted once and never reviewed.

The data read here is described as "non-sensitive". For an attacker, a list of names, email addresses and roles is nonetheless the raw material of targeted phishing: Chainalysis itself asks its users to watch for unexpected password reset requests and authentication prompts.

The signal is not isolated. In September, the Spanish data protection authority (AEPD) said it had received what appears to be the first notification of a data breach caused by an attack run through an AI agent, and asks that AI-assisted attacks be included in risk assessments. On 21 October, Microsoft described a campaign run with an agent tool against more than 2,250 Microsoft 365 customers (our article).

What a CIO should check this week

• The inventory of agents and service accounts with standing access to data: CRM, ticketing, documents, directories. For each one, a named owner, a list of permissions and a date of last review.
• Multi-factor authentication on every console that administers agents or AI assistants (Copilot Studio, Agentforce, Vertex, and internal tools). Chainalysis "strongly" urges it on its customers: it is the first line.
• The internal tools that agents call: which ones are reachable from outside, with which credentials, and how long since those credentials were rotated.
• The ability to answer within 24 hours the question "what could this agent have read?", from logs that were kept and dated, not rebuilt afterwards.

What a well-equipped team does differently

It logs every agent action with the identity of the actor, human or agent, and a timestamp. It limits each agent's permissions to actual need, and reviews them on a fixed schedule. And it can produce, for a given date, the list of an agent's accesses: the evidence, not the promise.

That is the logic of Cockpit: the AI register, with each system's use, owner, permissions and change history, and dated evidence that an auditor or an insurer can verify. For testing agent permissions with trained people, the Human in the Loop offer is activated on engagement.

The danger	The advice
The agents and service accounts acting in your environment are inventoried nowhere, or only by name.	Keep a register of agents and service accounts, with their permissions, a named owner and a date of last review.
A list of names, email addresses and roles is deemed "non-sensitive" and treated as such.	Treat it as the raw material of targeted phishing: warn agent users, and watch for unexpected reset requests.
After an incident, nobody can say what a compromised agent could have read, because its actions are not logged with the actor's identity.	Log every agent action, timestamped and attributed, and preserve those logs before any change.