Chainalysis kiberxavfsizlik hodisasini tasdiqladi — tashqi shaxs kompaniya tizimlari va ichki vositalariga ruxsatsiz kirish huquqini qo'lga kiritdi. Kompaniya buni "hujumkor agentik usullar" deb ta'rifladi. Hodisa 2026-yil 30-oktabrda e'lon qilindi va tergov hali ham davom etmoqda.
Kompaniyaning xavfsizlik bayonotiga ko'ra, tergovchilar tergov mazmuni, autentifikatsiya ma'lumotlari yoki sessiya tokenlariga ruxsatsiz kirish haqida hech qanday dalil topmadi. Biroq hujumchilar mijoz hisob ma'lumotlariga, jumladan foydalanuvchi IDlari, to'liq ismlar, elektron pochta manzillari va tashkilot rollari yorliqlariga kirishdi.
Chainalysis ruxsatsiz faoliyatni oktyabr oyida aniqlaganini, zaifliklarni tuzatish va tizimlarni mustahkamlashni boshlaganini aytdi. Bayonotda foydalanilgan zaifliklar, ta'sirlangan dasturiy komponentlar, dastlabki kirish vektori yoki bog'liq CVE identifikatorlari aniqlanmagan.
Agentik AI hujum usullariga ishora bu hodisani AI bilan bog'langan ish oqimlari tomon kengroq siljish doirasiga joylashtiradi — bu ish oqimlari razvedka, zaiflik tadqiqoti va ekspluatatsiya vazifalarini avtomatlashtirishi mumkin. Biroq Chainalysis qaysi harakatlar avtomatlashtirilganini yoki hujumchi qancha inson yo'nalishini saqlab qolganini ommaviy ravishda tushuntirmagan.
Shuning uchun mavjud ma'lumotlar to'liq avtonom kirish, nol kun zaifligi ekspluatatsiyasi yoki aniq tahdid aktori atribyutsiyasini tasdiqlamaydi.
Kompaniya ochilgan yozuvlarni "nozik bo'lmagan mijoz ma'lumotlari" deb tavsifladi. Shunga qaramay, ismlar, elektron pochta manzillari va rol yorliqlari maqsadli fishing kampaniyalari uchun foydali kontekst bo'lishi mumkin, ayniqsa qo'llab-quvvatlash xodimlarini taqlid qiladigan yoki hisobni tasdiqlashni so'raydigan xabarlar orqali. Bu potentsial keyingi xavf, bu hodisaning tasdiqlangan natijasi emas.
Chainalysis tergovda hujumchilar tergov graflari, eslatmalar, holatlar, tranzaksiya natijalari, so'rov natijalari, ochiq matn parollari, MFA sirlari yoki foydalanuvchi sessiya tokenlariga kirishganligi haqida hech qanday belgi topilmaganini aytdi.
Kompaniya har bir mijoz tashkilotiga tegishli qaysi yozuvlarga kirilganini hali aniqlamoqda. U mijozlarni faol ravishda xabardor qildi va tahlil davom etar ekan, tashkilotga xos tafsilotlarni va'da qildi.
Chainalysis tashqi kiberxavfsizlik mutaxassislarini jalb qildi va kengroq platforma xavfsizlik tekshiruvi uchun katta til modellardan foydalanmoqda. Uning tuzatish choralari foydalanilgan zaifliklardan tashqari qo'shimcha himoya yaxshilanishlarini ham o'z ichiga oladi.
Mijozlar kutilmagan parolni tiklash so'rovlari va autentifikatsiya so'rovlari uchun hushyor bo'lishlari kerak. Chainalysis, ayniqsa, ikki faktorli autentifikatsiyani hali yoqmagan tashkilotlarga buni qilishni tavsiya qiladi. Ko'p faktorli autentifikatsiya paroldan tashqari qo'shimcha tasdiqlash talablarini qo'shadi va ruxsatsiz hisob kirishini kamaytirishga yordam beradi.
Kompaniya shuningdek, bu hodisa Binance bilan bog'liq yaqindagi kriptovalyuta o'g'irlanishi bilan bog'liq emasligini aniq aytdi. Tergovchilar ruxsatsiz kirishning to'liq ko'lamini aniqlagan sari, mijozlarga qo'shimcha yangilanishlar kutilmoqda.
SOCingizga hodisalarni tez to'xtatish uchun ogohlantirish kontekstini bering.16K SOCdan tahdid razvedkasini integratsiya qiling.
Chainalysis has confirmed a cybersecurity incident in which an external actor gained unauthorized access to the company’s systems and internal tools through what it described as “offensive agentic techniques.” The company disclosed the incident on October 30, 2026, and its investigation is still ongoing.
According to the company’s security disclosure, investigators have found no evidence of unauthorized access to investigation content, authentication credentials, or session tokens. However, attackers accessed customer account information, including user IDs, full names, email addresses, and organizational role labels.
Chainalysis said it detected the unauthorized activity during October and began investigating, patching vulnerabilities, and strengthening its systems. The disclosure did not identify the exploited weaknesses, affected software components, initial access vector, or associated CVE identifiers.
Its reference to agentic AI attack techniques places the incident within a broader shift toward tool-connected AI workflows that can automate reconnaissance, vulnerability research, and exploitation tasks. However, Chainalysis has not publicly explained which actions were automated or how much human direction the attacker retained.
The available information therefore does not establish a fully autonomous intrusion, zero-day exploitation, or a specific threat actor attribution.
The company characterized the exposed records as “non-sensitive customer data.” Nevertheless, names, email addresses, and role labels could provide useful context for targeted phishing campaigns, particularly messages impersonating support personnel or requesting account verification. This is a potential follow-on risk, not a confirmed consequence of this incident.
Chainalysis said its investigation found no indication that attackers accessed investigation graphs, notes, cases, transaction results, query results, cleartext passwords, MFA secrets, or user session tokens.
The company is still determining which records belonging to each customer organization were accessed. It has proactively notified customers and promised organization-specific breakdowns as that analysis progresses.
Chainalysis has engaged external cybersecurity specialists and is using large language models to support a broader platform security review. Its remediation extends beyond the exploited vulnerabilities to additional defensive improvements.
Customers should remain vigilant for unexpected password reset requests and authentication prompts. Chainalysis specifically recommends that organizations that have not already enabled two-factor authentication do so. Multi-factor authentication adds verification requirements beyond a password, helping reduce unauthorized account access.
The company also explicitly stated that this incident is unrelated to the recent cryptocurrency theft involving Binance. Further customer updates are expected as investigators establish the full scope of unauthorized access.
Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.