Chainalysis Security Incident Information

Chainalysis disclosed that an external actor used "offensive agentic techniques" to gain unauthorized access to its systems and internal tools, with some non-sensitive customer data — user IDs, full names, email addresses and organization role labels — accessed. Chainalysis said it found no indication that investigation content such as graphs, notes or cases, transaction or query results, passwords in clear text, MFA secrets or user session tokens were accessed, and that the incident is unrelated to the recent crypto theft involving Binance. Chainalysis said it engaged third-party cybersecurity experts and is using large language models to review platform security, and urged customers to enable two-factor authentication.

Chainalysis was recently the target of a cybersecurity incident, similar to many other tech platforms in recent weeks. Based on the investigation to date, we have found no evidence of unauthorized access to investigation content, authentication credentials, or session tokens. Our team is working with leading cybersecurity experts to investigate this activity and harden our systems. We’ve proactively notified all of our customers and will keep them updated as our work progresses. This security incident is not related to the recent crypto theft at Binance. Below, you can find the full text of the email that was sent to impacted customers. Chainalysis is committed to the security of our platform and the protection of our customers’ data. We are seeing an industry-wide rise in AI-driven cyberattacks, and we are taking a whole-of-company approach to make sure our security posture meets the evolving environment and our customers’ expectations. In keeping with our commitment to transparency, we are writing to inform you of a security incident affecting your organization. Some of you have been previously notified and we want to provide an update on our work. Please note that this security incident is unrelated to the recent crypto theft involving Binance. What happened This month, Chainalysis detected an external actor using offensive agentic techniques to gain unauthorized access to Chainalysis systems and internal tools. Our teams have been working around the clock to investigate unauthorized activity, patch vulnerabilities, and harden our systems. Customer data impact Based on the evidence available to date, we have found no indication that these incidents resulted in the unauthorized access of investigation content such as graphs, notes, or cases , transaction or query results, passwords in clear text, MFA secrets, or user session tokens. Some non-sensitive customer data, such as user IDs, full names, email addresses, and organization role labels for users provisioned on our platform were accessed, including such information relating to your organization and users. We are in the process of determining the records for your organization that were accessed and will provide a detailed breakdown as soon as that analysis is complete. What we have done We have engaged world-class third-party cybersecurity experts and are using sophisticated large language models to support a broader review of our platform’s security and strengthen our defenses. This work extends beyond the exploited vulnerabilities to enhance our security posture across the platform. What you can do Chainalysis users should continue to be hyper-vigilant of unexpected password reset requests or authentication prompts. If your organization has not yet enabled two-factor authentication, we strongly recommend doing so. Your Chainalysis account manager can help you complete that process. What happens next We will provide you with updates relevant to your organization as our investigation progresses. We take the security of your data seriously and regret that this incident occurred. Respectfully, Your Chainalysis Team