EN PT-BR
← Voltar ao feed
high financial services law enforcement government finance media

Chainalysis breached via 'offensive agentic techniques': password hashes and live tokens later confirmed exposed, key products offline

8 fonte(s) · 4 atualização(ões) · 5 repetição(ões) · publicado 31/10/2026 09:01 · coletado há 1 hora

Matéria consolidada. Reúne 12 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 8 fontes trouxeram em 06/11/2026 06:02; os links antigos trazem para cá.

Fontes: thehackernews.com ×2 ↗ theregister.com ↗ helpnetsecurity.com ↗ infosecurity-magazine.com ↗ gbhackers.com ↗ securityweek.com ↗ securityaffairs.com ↗ bleepingcomputer.com ↗

Chainalysis, the blockchain analytics firm whose customers include exchanges, banks and law enforcement, disclosed on October 30, 2026 that an external actor used "offensive agentic techniques" to gain unauthorized access to its internal systems and tools earlier in October (bleepingcomputer.com, theregister.com). The first notice said only non-sensitive data was accessed: user IDs, full names, email addresses and organization role labels (thehackernews.com, bleepingcomputer.com). A November 4 update widened the scope sharply: usernames, password hashes and live authentication tokens for all users were exposed (theregister.com). On November 6, thehackernews.com also reported that the ongoing investigation had exposed names, usernames, password hashes and live tokens for all users, confirming the wider scope. The company called the intrusion an "on-path" (attacker-in-the-middle) attack and an "ongoing multifront cyberattack", and has not named a perpetrator (theregister.com). It took Reactor, Data Solutions, KYT and Address Screening, plus the login page, offline, and plans a phased restoration with mandatory password resets and API key rotation. Chainalysis says the incident is unrelated to the recent Binance hack, which U.S. authorities attributed to the North Korean group TraderTraitor (thehackernews.com).

Detalhes técnicos

  • Chainalysis has not disclosed which vulnerabilities were exploited, which internal tools were accessed, how long the attacker had access, or the tooling behind the "agentic" techniques (bleepingcomputer.com, thehackernews.com). It has not published the number of affected customers or organizations, and is still determining which records were accessed per organization (bleepingcomputer.com).
  • The November 4 update described an "on-path" (AitM) attack, noting similarities to attacks on "many other tech platforms in recent weeks". The hashing algorithm for the passwords was not disclosed, so the risk of offline cracking cannot be assessed (theregister.com).
  • The exposed data for all users, as restated on November 6, comprises names, usernames, password hashes and live tokens (thehackernews.com).
  • The company detected "abnormal activity" on its transaction-screening systems. It took the KYT user interface and API, Address Screening and the login page offline, and directly notified customers whose KYT accounts "appear to have been accessed without authorization" (theregister.com, citing chainalysis.com).
  • Chainalysis maintains there is no evidence that investigation data or attribution data was accessed or manipulated (theregister.com). The company repeated on November 6 that it continues to have no evidence that investigations data was accessed or that Chainalysis attribution data was manipulated, and said it removed access to Reactor and Data Solutions while investigating (thehackernews.com).
  • Context from the sources: the agentic penetration-testing framework ARTEX was used by the China state-backed group Vapor Panda to compromise roughly 140 targets in 11 days (thehackernews.com). Microsoft separately linked ARTEX to the ConnectWise supply chain compromise (bleepingcomputer.com). It is unconfirmed whether ARTEX or custom autonomous AI agents were used against Chainalysis (bleepingcomputer.com). Abnormal AI called agentic intrusion chains and prompt injection a distinct threat category (thehackernews.com).

Remediação

  • Chainalysis says it is patching vulnerabilities and hardening its systems. It has engaged outside cybersecurity experts, is using LLMs to support a broader security review, and will share further updates (bleepingcomputer.com, thehackernews.com).
  • Customers were notified by email and advised to watch for unexpected password reset requests or authentication prompts, enable two-factor authentication, and beware of social engineering, including scammers impersonating the company and offering fund recovery or recruiting services (bleepingcomputer.com, thehackernews.com).
  • The password-reset function is disabled during hardening. Users should change any passwords reused on other services (theregister.com).
  • KYT and Address Screening were planned to be restored on November 5. Customers must first submit trusted IP addresses to support or their account manager for an allowlist, then reset passwords. Once Reactor and Data Solutions are restored, every user must reset passwords and rotate API keys (theregister.com).

Relatos divergentes

  • Credential exposure: The initial disclosure, as reported by thehackernews.com and bleepingcomputer.com, said there was no evidence that cleartext passwords, MFA secrets, authentication credentials or session tokens were accessed. The later report from theregister.com (November 4 update) confirms password hashes and live tokens for all users were exposed, and thehackernews.com's November 6 article now says the same. The later sources are more current and supersede the earlier statement.
  • Products offline: thehackernews.com initially said Reactor and Data Solutions were taken offline proactively pending security assessments (with a November 3 date, despite the article's October 31 publication stamp); its November 6 article quotes the company as saying access was removed while it investigated. theregister.com says these products and KYT were taken offline after abnormal activity was detected. The later account describes the broader shutdown, including KYT, Address Screening and the login page.
  • Perpetrator and tooling: No source attributes the intrusion. ARTEX and Vapor Panda are cited only as context for AI-driven attacks and are not confirmed as involved.

Linha do tempo

  1. thehackernews.com ↗ · pub. 06/11/2026 05:04 · coletado 06/11 06:00

    Chainalysis Breach Exposes All Users' Credentials, Forces Shutdown of Key Services

    ler a análise desta fonte

    Blockchain analysis firm Chainalysis has revealed that its ongoing investigation into the agentic cyber attack targeting its systems also exposed names, usernames, password hashes and live tokens for all users.

    "While we investigated, we removed access to Reactor and Data Solutions," the company said. "At this time we continue to have no evidence that any investigations data has been accessed or Chainalysis attribution data has been manipulated."

  2. theregister.com ↗ · pub. 05/11/2026 15:03 · coletado 05/11 16:00

    Chainalysis Confirms Password Hashes, Live Tokens Exposed in Agentic 'On-Path' Breach

    This article adds that Chainalysis's November 4 update significantly worsened the known scope of the breach: password hashes and live authentication tokens for all users were confirmed exposed, contradicting the company's earlier statement that no authentication credentials or session tokens had been accessed. It also details the 'on-path' (AitM) attack vector, the suspension of the password-reset function, the shutdown of KYT, Address Screening, and the login page, and the phased restoration plan requiring IP allowlisting, mandatory password resets, and API key rotation.

    ler a análise desta fonte

    This article adds that Chainalysis's November 4 update significantly worsened the known scope of the breach: password hashes and live authentication tokens for all users were confirmed exposed, contradicting the company's earlier statement that no authentication credentials or session tokens had been accessed. It also details the 'on-path' (AitM) attack vector, the suspension of the password-reset function, the shutdown of KYT, Address Screening, and the login page, and the phased restoration plan requiring IP allowlisting, mandatory password resets, and API key rotation.

    Chainalysis confirmed in a late-Wednesday (November 4) update that attackers who breached its systems in October also obtained usernames, password hashes, and live authentication tokens, expanding significantly on its earlier disclosure that only non-sensitive identity data (user IDs, names, emails, role labels) had been exposed. The company has not disclosed the hashing algorithm used to protect the passwords, making it impossible to assess how easily the hashes could be cracked offline. Chainalysis described the intrusion as an "on-path attack" — also known as attacker-in-the-middle (AitM) — and an "ongoing multifront cyberattack," but has not named the perpetrator, only noting similarities to attacks on "many other tech platforms in recent weeks." The company's Reactor (used by international law-enforcement customers), Data Solutions, and KYT anti-money-laundering products were taken offline after "abnormal activity" was detected on its transaction-screening systems. Chainalysis maintains there is no evidence that investigation data or attribution data has been accessed or manipulated.

    Technical Details

    Chainalysis first disclosed the breach on October 30, stating an external actor used "offensive agentic techniques" to gain unauthorized access to its internal systems. The November 4 update significantly worsened the picture: the company confirmed that password hashes and live tokens for all Chainalysis users were exposed to the malicious actor, and that it had detected abnormal activity prompting it to take the KYT user interface and API, address-screening products, and the login page offline, directly notifying customers whose KYT accounts "appear to have been accessed without authorization" (chainalysis.com). The password-reset function itself has been disabled while the company hardens its systems, though users have been urged to change reused passwords on other services in the meantime.

    Remediation

    Chainalysis plans to restore KYT and Address Screening on November 5, requiring customers to submit trusted IP addresses to their support team or account manager for an allowlist before resetting passwords. Every user will be required to reset passwords and rotate API keys as part of hardened account-access protections once Reactor and Data Solutions are restored. The company says it is working around the clock with outside security experts to harden its systems and bring the affected products back online securely.

  3. bleepingcomputer.com ↗ · pub. 31/10/2026 09:50 · coletado 31/10 10:00

    Chainalysis Discloses Breach After Attackers Use "Offensive Agentic Techniques" Against Internal Systems

    This article adds detail on the timing and handling of the disclosure: Chainalysis published the incident notice on a Friday at roughly 5:14 PM ET, said the unauthorized access occurred "earlier this month," and is using large language models to support a broader security review while still determining which records were accessed per affected organization. It also clarifies that the agentic offensive framework ARTEX — one possible tool used in the intrusion, though unconfirmed — was separately linked by Microsoft to the ConnectWise supply chain compromise. The piece situates the Chainalysis breach within a broader wave of crypto/tech security incidents that same week, including Binance's attribution of its roughly $6.3 billion theft (the largest crypto heist on record) to North Korean state-backed hackers via a compromised DevOps engineer's laptop, a suspected hardware implant found in a Trezor Safe 5 device, and a malicious Cursor-marketplace version of Anthropic's Claude Code extension that planted SSH backdoors on developer machines — none of which are part of the Chainalysis incident itself.

    ler a análise desta fonte

    This article adds detail on the timing and handling of the disclosure: Chainalysis published the incident notice on a Friday at roughly 5:14 PM ET, said the unauthorized access occurred "earlier this month," and is using large language models to support a broader security review while still determining which records were accessed per affected organization. It also clarifies that the agentic offensive framework ARTEX — one possible tool used in the intrusion, though unconfirmed — was separately linked by Microsoft to the ConnectWise supply chain compromise. The piece situates the Chainalysis breach within a broader wave of crypto/tech security incidents that same week, including Binance's attribution of its roughly $6.3 billion theft (the largest crypto heist on record) to North Korean state-backed hackers via a compromised DevOps engineer's laptop, a suspected hardware implant found in a Trezor Safe 5 device, and a malicious Cursor-marketplace version of Anthropic's Claude Code extension that planted SSH backdoors on developer machines — none of which are part of the Chainalysis incident itself.

    Blockchain analytics firm Chainalysis disclosed a security incident in which an external actor used so-called "offensive agentic techniques" to gain unauthorized access to internal systems and tools earlier this month. The company says accessed customer data was limited to user IDs, full names, email addresses, and organizational role labels, with no evidence that investigation data, authentication credentials, or session tokens were exposed. Chainalysis is still determining which records were accessed per organization and is using large language models (LLMs) to support a broader security review of its platform, while working with external cybersecurity experts. The company stated the incident is unrelated to the recent Binance theft.

    Technical Details

    Chainalysis has not disclosed which vulnerabilities were exploited, which internal tools were accessed, or the duration of attacker access. It remains unclear whether the attackers relied on an existing agentic offensive security framework such as ARTEX — which, according to Microsoft, was also used in the ConnectWise supply chain compromise — or on custom-built autonomous AI agents capable of identifying and chaining exploits on their own.

    Remediation

    Chainalysis advised affected customers to enable two-factor authentication (2FA) and watch for unexpected password reset requests, authentication prompts, and scammers impersonating the company, particularly those offering fund recovery or recruiting services. The company says it is patching vulnerabilities, hardening its systems, and will share further updates as its investigation progresses.

  4. thehackernews.com ↗ · pub. 31/10/2026 09:01 · coletado 31/10 10:00 primeiro registro

    Chainalysis Confirms AI-Driven Intrusion Exposing Customer Identity Data

    ler a análise desta fonte

    Chainalysis, a U.S. blockchain analytics firm whose customers include crypto exchanges, banks, and law enforcement agencies worldwide, disclosed that an external actor used "offensive agentic techniques" to gain unauthorized access to its internal systems and tools in October 2026. The company said the intruder accessed non-sensitive customer data, including user IDs, full names, email addresses, and organization role labels for users provisioned on its platform, but found no evidence that investigation content (graphs, notes, cases), transaction or query results, cleartext passwords, MFA secrets, or session tokens were accessed (chainalysis.com, via helpnetsecurity.com). Chainalysis has not disclosed the specific tactics or tooling behind the "offensive agentic techniques," and has not published the number of affected customers or organizations (cybersecuritynews.com). The company stated the incident is unrelated to the recent Binance hack, which Chainalysis itself has been investigating and which U.S. authorities attributed to the North Korean group TraderTraitor (helpnetsecurity.com).

    Technical Details

    The disclosure frames the intrusion within a broader trend: "We are seeing an industry-wide rise in AI-driven cyber attacks, and we are taking a whole-of-company approach to make sure our security posture meets the evolving environment and our customers' expectations," Chainalysis said. The article notes this comes as adversarial use of AI has intensified, citing a separate campaign by a China state-backed group tracked as Vapor Panda, which used an agentic penetration-testing framework called ARTEX to compromise roughly 140 targets in 11 days as part of a broad access operation. Abnormal AI commented that "agentic intrusion chains and prompt injection" are a distinct category of threat because they depend directly on deployed AI systems, as opposed to AI simply accelerating established attack techniques.

    Remediation

    Chainalysis said it is patching vulnerabilities and hardening its systems, has engaged third-party cybersecurity experts to investigate and review platform security, and as of November 3, 2026, proactively took certain products offline — including Reactor and Data Solutions — pending additional security assessments (helpnetsecurity.com). The company notified affected customers by email, urging them to watch for unexpected password reset requests or authentication prompts, enable two-factor authentication, and remain vigilant against social engineering given the exposure of names and contact details to an actor targeting an organization whose clients include law enforcement and government agencies.

Repetiram sem novidade