Chainalysis confirms unauthorized access to internal systems and customer data

Chainalysis detected an external actor using “offensive agentic techniques” to gain unauthorized access to its systems and internal tools in October, according to the company’s October 30 security advisory. The firm said it found no evidence of unauthorized access to investigation content, authentication credentials or session tokens.

Chainalysis described the accessed information as non-sensitive customer data, including account and organizational identifiers — specifically user IDs, full names, email addresses, and organization role labels — the kind of information that tells an adversary who works where and under what role.

“Chainalysis was recently the target of a cybersecurity incident, similar to many other tech platforms in recent weeks,” the Chainalysis Team wrote. The company said it is working with cybersecurity experts and using large language models to support a broader review of its platform’s security.

On October 28, Coinbase Support posted that a security incident at analytics vendor Amplitude affected contact data belonging to a “small subset” of Coinbase customers, among other Amplitude customers, as Decrypt reported. Coinbase Support also posted, “Coinbase has not had a data breach,” and Coinbase found no evidence of unauthorized access to its own systems; customer funds were not affected.

The access path differs between the two cases. Coinbase’s exposure ran through a third-party analytics vendor. Chainalysis describes direct unauthorized access to its own systems and internal tools.

The pattern extends further back. Trezor reported in September that a breach at shipping provider ShipMonk exposed names, phone numbers, and home addresses of 67,000 U.S. customers. Trezor had disclosed nearly 14,000 additional customers in August, putting the two Trezor shipping-provider exposures at approximately 81,000 combined. Those figures are specific to ShipMonk’s incident and have no bearing on Chainalysis.

Chainalysis framed the episode as part of an industry-wide rise in AI-driven cyberattacks.