Blokcheyn razvedka firmasi Chainalysis xavfsizlik hodisasini oshkor qildi — hujumchilar "hujumkor agentik texnikalar" deb ta'riflangan usullardan foydalanib, uning ichki tizimlari va vositalariga ruxsatsiz kirish huquqini qo'lga kiritgan.
Kompaniya ma'lum qilishicha, ba'zi mijoz ma'lumotlari, jumladan ismlar, elektron pochta manzillari, foydalanuvchi identifikatorlari va tashkilotdagi rol yorliqlari ochilgan, ammo sezgir tekshiruv ma'lumotlari yoki autentifikatsiya ma'lumotlari ochilganiga dalil yo'q.
Chainalysis hujumchilar ichki tizimlar va vositalarga kirganini aytadi
Chainalysis kriptovalyuta tranzaksiyalarini kuzatish va firibgarlik, to'lov dasturlari (ransomware) va pul yuvish kabi jinoyatlarni tekshirish uchun huquqni muhofaza qilish organlari, davlat agentliklari, kriptovalyuta birjalari va moliyaviy muassasalar tomonidan foydalaniladigan blokcheyn tahlil vositalarini taqdim etadi.
Juma kuni, taxminan ET vaqti bilan 17:14 da, Chainalysis xavfsizlik hodisasi haqida e'lon va ta'sirlangan mijozlarga yuborilgan elektron pochta matnini to'liq nashr etdi.
E'londa aytilishicha, kompaniya shu oy boshida tashqi aktyor "hujumkor agentik texnikalar"dan foydalanib tizimlari va ichki vositalariga ruxsatsiz kirganini aniqlagan va shundan beri zaifliklarni tuzatib, tizimlarini mustahkamlamoqda.
Ochilgan ma'lumotlar platformada ro'yxatdan o'tgan foydalanuvchilarning foydalanuvchi identifikatorlari, to'liq ismlari, elektron pochta manzillari va tashkilotdagi rol yorliqlarini o'z ichiga oladi.
Chainalysis har bir tashkilot uchun qaysi yozuvlar ochilganini hali aniqlamoqda va tahlil tugagach batafsil taqsimot taqdim etadi.
Chainalysis vakili BleepingComputer'ga hodisani tasdiqladi va kompaniya tashqi kiberxavfsizlik mutaxassislari bilan ishlayotganini aytdi. Shuningdek, u platformaning kengroq xavfsizlik tekshiruvini qo'llab-quvvatlash uchun katta til modellari (LLM) dan foydalanmoqda.
"Hozirgi tekshiruv natijalariga ko'ra, biz tekshiruv mazmuni, autentifikatsiya ma'lumotlari yoki sessiya tokenlariga ruxsatsiz kirish haqida hech qanday dalil topmadik", — dedi kompaniya va bu hodisa yaqinda Binance'dan o'g'irlangan mablag'lar bilan bog'liq emasligini qo'shib qo'ydi.
Mijozlarga ikki omilli autentifikatsiyani (2FA) yoqish va kutilmagan parolni tiklash so'rovlari, autentifikatsiya so'rovlari va Chainalysis nomidan firibgarlar, ayniqsa mablag'larni qaytarish yoki ishga yollash xizmatlarini taklif qiluvchilar tomonidan yuborilgan xabarlarga e'tiborli bo'lish tavsiya etiladi.
Chainalysis hujumning texnik tafsilotlarini, jumladan qaysi zaifliklar ishlatilganini, qaysi ichki vositalarga kirilganini yoki hujumchilar qancha vaqt kirish huquqiga ega bo'lganini oshkor qilmagan.
Hujumchilar mavjud agentik hujumkor xavfsizlik tizimlari, masalan ARTEX, yoki zaifliklarni avtonom ravishda aniqlash, ularni ishlatish va keyingi harakatlarni zanjirga ulash qobiliyatiga ega maxsus qurilgan AI agentlaridan foydalanganmi — bu aniq emas.
Microsoft ma'lumotlariga ko'ra, ARTEX yaqinda tahdid aktyorlari, jumladan ConnectWise ta'minot zanjiri buzilishida ishlatilgan.
"Agentik" atamasi odatda cheklangan inson aralashuvi bilan ko'p bosqichli vazifalarni bajarishga qodir AI tizimlarini anglatadi, bu esa hujumchilarga an'anaviy qo'lda ishlatiladigan usullarga tayanmasdan, kirish jarayonining bir qismini avtomatlashtirish imkonini berishi mumkin.
Xavfsizlik hodisalarining tinimsiz haftasi
Chainalysis e'loni kriptovalyuta va texnologiya sohalariga ta'sir qilgan tinimsiz xavfsizlik hodisalari haftasi fonida e'lon qilindi.
Juma kuni Binance taxminan 6,3 milliard dollarlik o'g'irlikni — hozirda rekord darajadagi eng katta kripto o'g'irligi va Shimoliy Koreya davlat homiyligidagi xakerlarga bog'langan — DevOps muhandisining noutbukiga zarar yetkazilganiga bog'ladi.
Alohida, apparat hamyon ishlab chiqaruvchisi Trezor Janubi-Sharqiy Osiyo sotuvchisi orqali sotib olingan Trezor Safe 5 qurilmasida topilgan shubhali kriptovalyuta o'g'irlovchi apparat implantidan shubhalanayotganini ogohlantirdi. Shubhali implant qurilmada ko'rsatilgan tiklash iboralarini qo'lga kiritishi mumkin.
Shu bilan birga, Anthropic'ning rasmiy Claude Code kengaytmasining zararli versiyasi Cursor kengaytma bozori orqali tarqatilib, ishlab chiquvchilarning mashinalariga doimiy SSH orqa eshiklarini joylashtirdi.
Chainalysis tekshiruv davom etar ekan, ta'sirlangan mijozlarga qo'shimcha yangilanishlar taqdim etilishini aytdi.
Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37 foizi bloklanadi
Umumiy oldini olish ko'rsatkichlari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalanayotganda, oldini olish keskin pasayadi.
Blue Report 2026 mijozlarning ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnika-texnika mudofaa choralarini o'lchaydi.
Hisobotni oling
Blockchain intelligence firm Chainalysis has disclosed a security incident after attackers used what it describes as "offensive agentic techniques" to gain unauthorized access to its internal systems and tools.
The company says some customer information was accessed, including names, email addresses, user IDs, and organizational role labels, but claims there is no evidence that sensitive investigation data or authentication credentials were exposed.
Chainalysis says attackers accessed internal systems and tools
Chainalysis provides blockchain analytics tools used by law enforcement, government agencies, cryptocurrency exchanges, and financial institutions to trace cryptocurrency transactions and investigate crimes such as fraud, ransomware, and money laundering.
On Friday, roughly 5:14 PM ET, Chainalysis published a security incident disclosure along with the full text of the email sent to affected customers.
The disclosure says the company detected an external actor using "offensive agentic techniques"to gain unauthorized access to its systems and internal tools earlier this month, and has since been patching vulnerabilities and hardening its systems.
The accessed data includes user IDs, full names, email addresses, and organizational role labels for users provisioned on the platform.
Chainalysis is still determining which records were accessed for each organization and will provide a detailed breakdown once that analysis is complete.
A Chainalysis spokesperson confirmed the incident to BleepingComputer and said the company is working with external cybersecurity experts. It is also using large language models (LLMs) to support a broader security review of its platform.
"Based on the investigation to date, we have found no evidence of unauthorized access to investigation content, authentication credentials, or session tokens,"the company said, adding that the incident is unrelated to the recent Binance theft.
Customers are advised to enable two-factor authentication (2FA) and watch for unexpected password reset requests, authentication prompts, and scammers impersonating Chainalysis, particularly those offering fund recovery or recruiting services.
Chainalysis has not shared technical details about the intrusion, including which vulnerabilities were exploited, which internal tools were accessed, or how long the attackers had access.
It is unclear whether the attackers used existing agentic offensive security frameworks, such as ARTEX, or custom-built AI agents capable of autonomously identifying vulnerabilities, exploiting them, and chaining together subsequent actions.
ARTEX has recently been used by threat actors, including in the ConnectWise supply chain compromise, according to Microsoft.
The term "agentic" generally describes AI systems capable of executing multi-step tasks with limited human intervention, potentially allowing attackers to automate portions of the intrusion process rather than relying on traditional hands-on exploitation.
A relentless week of security incidents
The Chainalysis disclosure comes amid a relentless week of security incidents affecting the cryptocurrency and technology industries.
On Friday, Binance linked the roughly $6.3 billion theft, now the largest crypto heist on record and attributed to North Korean state-backed hackers, to a compromised DevOps engineer's laptop.
Separately, hardware wallet maker Trezor warned of a suspected cryptocurrency-stealing hardware implant discovered in a Trezor Safe 5 device purchased through a Southeast Asian reseller. The suspected implant could potentially capture recovery phrases displayed on the device.
Meanwhile, a malicious version of Anthropic's official Claude Code extension was distributed through the Cursor extension marketplace, planting persistent SSH backdoors on developers' machines.
Chainalysis says it will share further updates with affected customers as its investigation progresses.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report