Chainalysis Calls It 'Non-Sensitive.' It Is a Roster of the People Who Trace Stolen Crypto.

4:14 PM Central, on a Friday

At 4:14 PM Central on Friday, October 30, according to the timestamp in its own publishing system, Chainalysis put a post on its corporate blog titled "Chainalysis Security Incident Information." It was signed "Chainalysis Team." Thirty-three minutes later someone edited it. Below a short introduction sat the full text of an email the company said it had sent to impacted customers.

The email said that "this month, Chainalysis detected an external actor using offensive agentic techniques to gain unauthorized access to Chainalysis systems and internal tools." It said the actor reached "user IDs, full names, email addresses, and organization role labels for users provisioned on our platform." It called that data "non-sensitive."

Nearly 12 hours earlier, at 4:34 AM Central, the same blog had published Chainalysis's tracing of the Binance theft, the largest digital-asset theft on record, which the company attributes to North Korea. Two days before that, at 2:16 PM Central on October 28, it had published a post on Treasury sanctions against people supporting North Korean IT worker fraud. The firm that tells banks, exchanges and governments where North Korea's money goes had just told its customers that someone had walked through its internal tools and accessed the names, email addresses and role labels of the people who use its platform.

The incident is not the story. Breaches of software vendors are a weekly event now, and Chainalysis says it has found no evidence that investigation content was accessed. The story is the word "non-sensitive." For most vendors, a list of customer users' names, work emails and roles is a marketing asset. For Chainalysis, which by its own description serves government agencies, exchanges, financial institutions and cybersecurity companies in more than 70 countries, and whose government customers have included U.S. federal law enforcement, it is a roster of the people who investigate crypto crime, sorted by employer and by what they are allowed to do. An unnamed actor reached that roster in the same month the FBI named North Korea for a $6.3 billion theft those same people are tracing. Chainalysis says the two events are unrelated, and no one has attributed the intrusion.

This page reads Chainalysis's notice line by line, lists what Cloudskope checked first-hand, and sets out what boards, compliance chiefs and lenders should ask before they accept the word "non-sensitive." The facts page, with a running list of unknowns, is in our Breach Library.

What Chainalysis said, sentence by sentence

The notice is short. It deserves to be read the way a regulator would read it: for what each sentence establishes and for what it leaves out.

"Chainalysis was recently the target of a cybersecurity incident, similar to many other tech platforms in recent weeks." The opening frames the event as one instance of a wave. That framing is not wrong. October 2026 brought Microsoft's attribution of the ConnectWise Cloud Backup compromise to a China-aligned actor using an agentic penetration-testing framework, CrowdStrike's report of a second actor using the same framework against more than 200 organizations, and a run of breaches at AI developer platforms. But a wave is context, not a cause. The sentence tells a customer nothing about how Chainalysis itself was entered.

"Based on the investigation to date, we have found no evidence of unauthorized access to investigation content, authentication credentials, or session tokens." This is the reassurance customers most needed, and it is carefully bounded: "to date" and "no evidence." The customer email underneath it is more specific. It lists "investigation content (such as graphs, notes, or cases), transaction or query results, passwords in clear text, MFA secrets, or user session tokens." Note the phrase "passwords in clear text." It says nothing about password hashes. A company that had confirmed hashes were untouched would ordinarily say so. Chainalysis may simply have chosen precise wording. It is a question a customer's security team should ask in writing.

"We've proactively notified all of our customers and will keep them updated as our work progresses." Then, in the email: "we are writing to inform you of a security incident affecting your organization. Some of you have been previously notified and we want to provide an update on our work." Two facts follow. The email went to impacted customers, and at least some of them had already been told before this email. Chainalysis has not said when those first notices went out, or when the intrusion was detected. "This month" is the only date in the document.

"Based on the evidence available to date, we have found no indication that these incidents resulted in..." The introduction speaks of "a cybersecurity incident." The customer email speaks of "these incidents." One intrusion described two ways, or more than one intrusion? The notice does not say. The difference matters for anyone trying to determine whether the actor came back after the first notice went out.

"Some non-sensitive customer data, such as user IDs, full names, email addresses, and organization role labels for users provisioned on our platform were accessed, including such information relating to your organization and users." The words "such as" make the list an example, not a boundary. The company then says it is "in the process of determining the records for your organization that were accessed." In other words, as of the email, Chainalysis knew which categories of data had been reached but not yet which customers' records. It notified everyone. That is the right instinct. It also means no customer could know its own exposure on the day it was told.

"We have engaged world-class third-party cybersecurity experts and are using sophisticated large language models to support a broader review of our platform's security and strengthen our defenses. This work extends beyond the exploited vulnerabilities..." The phrase "the exploited vulnerabilities" is the only place the notice concedes a mechanism. Vulnerabilities, plural, were exploited. Which ones, in what software, and whether they were Chainalysis's own code or a supplier's, the notice does not say.

"If your organization has not yet enabled two-factor authentication, we strongly recommend doing so." Read plainly, this sentence says that two-factor authentication on Chainalysis's platform is something a customer organization enables, not something Chainalysis enforces. We return to that below.

"This security incident is not related to the recent crypto theft at Binance." The notice says this twice. Chainalysis is in a position to know its own forensic picture, and we take the statement at face value. We note only that it is a conclusion, offered without the timeline, mechanism or actor information that would let anyone else check it.

What the notice does not contain is as instructive as what it does. It has no detection date. No date for the earlier notices. No count of customers, users or records. No vulnerability, product or supplier. No explanation of what "offensive agentic techniques" means in this case. No statement on whether any government environment, including the one Chainalysis operates under a federal cloud authorization, was in scope. No mention of law enforcement or regulators. No actor. The Block's Zack Abrams reported on October 31 that "Chainalysis declined to answer specific follow-up questions from The Block."

What we verified, and what nobody has

Cloudskope ran the following passive checks between 1:55 AM CDT and 1:08 AM CST on Sunday, November 1 (daylight saving time ended at 2:00 AM, so the clock ran back an hour during the work). Every check was an ordinary page load, a public API call or a public DNS lookup. Commands, hashes and raw results are in our evidence log.

• The notice is where Chainalysis says it is, and its timestamps hold together. The page returned HTTP 200 at 1:56 AM CDT. Its embedded metadata, the WordPress REST API record for post 30695, the RSS feed and the sitemap all agree: published 21:14:00 UTC (4:14 PM CDT) on October 30, modified 21:47:47 UTC (4:47 PM CDT). The page carries no instruction to search engines not to index it, and it appears on the blog index and at the top of the feed. Chainalysis did not bury it.
• One outlet looked and did not find it. DiarioBitcoin's Angel Di Matteo published a story at 6:47 PM CDT on October 30, two and a half hours after the WordPress timestamp, saying that at the time of writing Chainalysis had neither confirmed nor denied the report on its X account or corporate blog. WordPress lets an author set a post's date. We cannot tell whether the post went live at 4:14 PM or later in the evening, and we say so. Chainalysis can answer it from its own logs.
• The blog sequence. Chainalysis's three most recent posts before the notice were the North Korean IT worker sanctions post (October 28, 2:16 PM CDT), a regional adoption report (October 29), and its Binance tracing post (October 30, 4:34 AM CDT).
• Email authentication on chainalysis.com is strict. The domain publishes a DMARC policy of p=reject, so mail that fails authentication while claiming to be from chainalysis.com should be refused by receiving servers that honor the policy. That protects against exact-domain spoofing. It does nothing against lookalike domains.
• Lookalikes. Our certificate-transparency queries to crt.sh failed twice and urlscan's wildcard search requires an account, so we could not run a full lookalike sweep. Of ten obvious variants we checked by DNS and RDAP, none was registered in October. Two are outside the company's apparent control: chainalysis.io redirects to a domain-sale page, and chainalysis.org, registered May 21, 2025 through Spaceship, Inc., serves a parking redirect. The registrant of the .org is not identified in public records we could read. chainalysis-gov.com redirects to the company's government-solutions page and appears to be company-controlled.
• Where users sign in. login.chainalysis.com is a CNAME to an Auth0 tenant in Auth0's EU region; the product hosts reactor, kyt and app sit behind Cloudflare and answered normally (200, 200 and a 302 to the login page). Nothing about the sign-in front door looked changed or degraded. We did not attempt to sign in and did not test authentication.
• Federal authorization. The FedRAMP Marketplace lists Chainalysis Reactor as FedRAMP Certified since September 16, 2025, Rev5, agency path, Moderate impact, with one authorization. Whether the October intrusion touched the authorized environment is not stated anywhere public.
• No extortion listing. ransomware.live had no victim matching "chainalysis" at 1:04 AM CST. No group has claimed the intrusion.
• No public-company disclosure. SEC EDGAR full-text search found one Item 1.05 cybersecurity 8-K filed from October 28 through November 1, from an energy-services company unrelated to this incident. Chainalysis is private. Its name appears in 22 SEC filings this year; the most consequential, discussed below, is its lender's quarterly report filed the day before the notice.

What we could not verify, and nobody outside Chainalysis has: the detection date, the date of the first customer notices, how many customer organizations and users were affected, which vulnerabilities were exploited, how AI agents were involved, whether a government environment was in scope, whether CISA or any agency was notified, and who did it. The intrusion was first flagged publicly by the International Cyber Digest account on X, according to The Block. We did not read or rely on that post.

A customer list is a different thing when the customers are investigators

Chainalysis describes itself as "the blockchain data platform" and says on its company page that it serves government agencies, exchanges, financial institutions and cybersecurity companies in more than 70 countries, with "1500+ customers." In May 2022, when it raised $170 million at an $8.6 billion valuation in a round led by GIC, TechCrunch reported it had more than 750. The customer base roughly doubled in four years.

The public sector side is documented. In February 2020, CoinDesk's Danny Nelson, working from federal procurement records, counted $10.69 million in federal spending with Chainalysis since 2015 and named the IRS as its largest federal customer, followed by Immigration and Customs Enforcement and the FBI, with contracts also at the DEA, SEC, CFTC, FinCEN and the Secret Service. Chainalysis Government Solutions sued in the Court of Federal Claims in July 2026 after ICE gave a rival, TRM Labs, a $94.6 million sole-source award, according to Cointelegraph. The company's Reactor investigations product holds a federal cloud authorization. On the private side, Chainalysis's KYT product screens transactions for exchanges and banks, which means the users of that product are compliance analysts and BSA officers.

Now read the four data elements again with those customers in mind. A user ID. A full name. A work email address. An "organization role label." Chainalysis has not published what its role labels are. On most enterprise platforms a role label distinguishes an administrator from an analyst from a read-only user. Put the four together and you have, for every affected organization, the names of the people who run crypto investigations or transaction monitoring there, how to email them, and which of them hold administrative rights over the organization's account.

That is not a marketing list. It is the targeting package an intelligence service or a fraud crew would otherwise spend weeks building from professional networking sites. Chainalysis's notice says as much in its own advice: "Chainalysis users should continue to be hyper-vigilant of unexpected password reset requests or authentication prompts." A company does not warn about password-reset phishing over data it truly regards as harmless.

The word "non-sensitive" is defensible in one narrow sense. Under most U.S. state breach-notification statutes, a name and work email without a password, Social Security number or account number is not personal information that triggers a notice. Under the federal customer-information rules discussed below, an employee's business contact details are not customer information. The label is accurate as a legal category. It is inaccurate as a description of risk, and the people on the list are the ones who carry the difference.

North Korea's playbook starts with names and job titles

Chainalysis says this incident is unrelated to Binance, and we are not connecting them. What we are pointing out is what the FBI has said, in writing, about how North Korean actors, the actors it blames for Binance, choose their victims.

On September 3, 2024, the FBI published public service announcement I-090324-PSA, "North Korea Aggressively Targeting Crypto Industry with Well-Disguised Social Engineering Attacks." The first tactic it lists is "Extensive Pre-Operational Research." The FBI wrote: "Before initiating contact, the actors scout prospective victims by reviewing social media activity, particularly on professional networking or employment-related platforms." The second is "Individualized Fake Scenarios" that "incorporate personal details regarding an intended victim's background, skills, employment, or business interests." A verified list of who works on crypto investigations at which organization, with role labels, is that pre-operational research, done.

The precedent is older than the PSA. On January 25, 2021, Google's Threat Analysis Group disclosed a campaign aimed at "security researchers working on vulnerability research and development," run by what it called "a government-backed entity based in North Korea." The attackers built a fake research blog and fake researcher personas, then approached their targets as collaborators. The people who study North Korean operations have been North Korean targets for at least five years.

The Binance theft is the most recent reminder of where those approaches lead. Binance has said attackers compromised an engineer's laptop and reached a service container, according to The Block; Binance co-CEO Richard Teng has since said the breach was more complex than a single employee's permissions. Chainalysis, Elliptic and TRM attributed the theft to North Korean groups, and Chainalysis CEO Jonathan Levin named TraderTraitor, according to CBS News and the Associated Press. On October 31, the FBI attributed the theft to TraderTraitor, according to Al Jazeera and Reuters. Binance has not published a root-cause report, and nothing public ties the laptop to any Chainalysis data.

Here is the sequence, with the caveat that Chainalysis says the events are unrelated and no one has attributed its intrusion. During October, an unnamed actor accessed the names and roles of people who use the leading blockchain-analytics platform. On October 29, North Korea, per the FBI, stole about $6.3 billion. By October 30, Chainalysis had notified its customers, some of them earlier, that their users' names and roles had been accessed. They are now the people tracing the money, freezing what can be frozen, and building the cases. Every one of them should assume their next unexpected recruiter, conference invitation, research collaboration or "Chainalysis support" email is a test.

"Offensive agentic techniques" is a phrase, not a finding

Chainalysis described the attacker's method, in a customer notice, as "offensive agentic techniques." It is worth being exact about what that does and does not tell us.

The phrase has a context. On October 21, Microsoft Threat Intelligence published its attribution of the ConnectWise Cloud Backup compromise to Storm-0940, which it described as "a China-state aligned actor," using ARTEX, "an open-source penetration testing framework that can use any AI model," to "automate attacks targeting hundreds of organizations globally." Microsoft reported that in multiple cases the time from initial targeting to privileged access was less than three hours. On October 29, CrowdStrike reported that an actor it tracks as Vapor Panda had used ARTEX "against more than 200 distinct organizations worldwide" beginning October 17, "primarily with the Chinese-origin DeepSeek LLM," listing the financial sector among its U.S. targets. In November 2025, Anthropic reported that a group it assessed as Chinese state-sponsored had used AI to execute "80-90% of tactical operations independently" against roughly 30 entities.

Chainalysis named none of these. It did not name a framework, a model, an actor or a technique. "Agentic" could mean an autonomous tool chaining reconnaissance, exploitation and data access at machine speed. It could mean a human operator using an AI assistant to write a payload. The defensive implications differ. The first means the window between a public vulnerability and its exploitation against you has collapsed to hours, and that log review has to assume activity in bursts too fast for a human analyst to follow in real time. The second means very little that is new.

There is a symmetry in the notice that deserves a sentence. Chainalysis says the attacker used agents, and that Chainalysis is now "using sophisticated large language models to support a broader review of our platform's security." On the laundering side of the same week, Elliptic wrote of the Binance proceeds that "the Binance funds are being moved by something that does not sleep" and that "the pattern is almost certainly software-driven." Chainalysis itself reported "laundering patterns we have not seen before" and said that "thousands of transactions in a short period suggest that the attackers are using automation," in its own October 30 tracing post. The attackers automated the break-in and the getaway. The defenders are automating the investigation. The one part of the chain that cannot be automated is the human being on the roster, deciding whether to open an attachment.

We are not attributing this intrusion to Storm-0940, Vapor Panda, North Korea or anyone else. We are saying that the phrase Chainalysis chose describes a category of threat that two of the largest threat-intelligence teams in the world documented against hundreds of organizations in the same month, and that customers are entitled to know which part of that category reached Chainalysis.

Two-factor authentication is still a recommendation

The most consequential sentence in the notice for a customer's board is a single line of advice: "If your organization has not yet enabled two-factor authentication, we strongly recommend doing so. Your Chainalysis account manager can help you complete that process."

It tells us three things. Two-factor authentication on the platform is enabled per customer organization. Some customer organizations had not enabled it as of October 30. And turning it on is a process that involves an account manager, not a switch Chainalysis flips. A UK government procurement listing for Chainalysis Reactor, resold by Bechtle on the G-Cloud framework, lists "2-factor authentication" among the platform's user-authentication options, alongside username and password.

The notice says MFA secrets were not accessed. That is good. It also means that for organizations without two-factor authentication, the only thing standing between a phishing email built from the accessed roster and a working session on an investigations platform is a password.

The precedent here is not hypothetical. In 2024, the actor Mandiant tracked as UNC5537 used credentials stolen by infostealer malware to log into Snowflake customer accounts that did not have multi-factor authentication. About 165 organizations were notified as potentially exposed. Ticketmaster, AT&T and Santander were among the organizations whose data was taken. Snowflake's own systems were not breached. The lesson the industry took was that a platform holding sensitive customer data should not leave multi-factor authentication optional, and Snowflake moved to require it by default for new accounts and announced it would block single-factor password sign-ins by November 2025. An investigations platform holding case graphs, notes and query history on active criminal and sanctions matters is a stronger case for that rule than a data warehouse.

Chainalysis should say whether two-factor authentication is now mandatory for every user, and when that became true. A customer whose users signed in with a password alone during October should treat its own Chainalysis accounts as in scope for review, regardless of what Chainalysis's investigation of Chainalysis's systems finds.

The trackers have been tracked before

Chainalysis has no prior public breach of its systems that we could find. It has had two leaks of its own materials. In September 2021, slides from a Chainalysis presentation to Italian police surfaced on a dark-web site, describing its ownership of the WalletExplorer service and techniques for linking IP addresses to transactions, as ForkLog reported, citing CoinDesk. In September 2024, a Chainalysis training video on Monero tracing leaked; a spokesperson told Cointelegraph the company had "no comment to share at this time." Neither was described as a hack of Chainalysis systems. Both showed that adversaries prize the investigators' methods.

The broader pattern is the targeting of the systems law enforcement uses to talk to industry. In October 2023, 404 Media's Joseph Cox reported that hackers were taking over accounts on Kodex, a platform companies use to receive law-enforcement data requests; one compromised account appeared to belong to a national police force, and its request panel listed Binance and Coinbase among the companies it could query. In November 2024, KrebsOnSecurity quoted an FBI private industry notification warning that "cybercriminals are likely gaining access to compromised US and foreign government email addresses" and using them to send fraudulent emergency data requests. The value of a law-enforcement identity, to a criminal, is the authority it carries with the companies that hold data. A list of which investigators work at which agency, with their real email addresses, is raw material for exactly that kind of impersonation, in both directions: posing as the investigator to the exchange, and posing as the exchange, or as Chainalysis, to the investigator.

Whose clock is it?

When a vendor tells its customers that their users' names and roles were accessed, each customer has to decide whether it owes anyone a notice. For most of them, under the rules as written, the answer is no. That is the problem.

The federal cloud rule. Under the FedRAMP incident communications procedures that governed Rev5 authorizations (now posted as legacy reference during the transition to FedRAMP's 2026 consolidated rules), a cloud service provider must report suspected and confirmed incidents "within one (1) hour of being identified" to impacted customers, to CISA where the attack vector falls within CISA's federal notification guidelines, to FedRAMP's security inbox, and to agency points of contact including the authorizing official, followed by daily updates. Chainalysis Reactor holds that authorization. If the October intrusion touched the authorized environment, a one-hour clock started on the day it was identified. If it did not, Chainalysis should say so, because government users reading "this month" cannot tell which environment their records lived in.

The bank rules. A bank's 36-hour notice duty under the 2021 computer-security incident rule runs to its primary federal regulator when the bank determines that a notification incident has occurred, including one that originated at a vendor, meaning one that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the bank's operations or services. The companion duty on bank service providers requires notice to bank customers only when an incident has caused or is reasonably likely to cause a material disruption of covered services for four or more hours. Unauthorized access to user directory data at a monitoring vendor that kept running disrupts nothing. Neither rule is likely to be triggered.

New York. The New York Department of Financial Services' Part 500 is broader. Section 500.17 requires a covered entity to notify the department within 72 hours of determining that a cybersecurity incident has occurred at the covered entity, its affiliates, or a third-party service provider, if the incident meets one of the regulation's thresholds, which include incidents reasonably likely to materially harm normal operations and incidents that require notice to another government body. Most covered banks and licensed virtual-currency businesses that use Chainalysis will conclude, reasonably, that this one does not meet a threshold. A few may conclude that a confirmed breach at the vendor that monitors their transactions for sanctions exposure, followed by targeted phishing of their compliance staff, is something their supervisor would want to hear about from them first.

Customer-data rules. The SEC's amended Regulation S-P (broker-dealers, investment advisers, funds and transfer agents), the FTC's Safeguards Rule (non-bank financial institutions) and the banking agencies' interagency GLBA security guidelines all turn on customer information. A firm's own employees' business contact details are not customer information. None of them applies.

This is materiality asymmetry in its cleanest form. For each customer, the incident is plausibly immaterial and plausibly not reportable. For Chainalysis, it is a breach of the one asset that is irreplaceable: the trust of the people whose job is to trust nothing. And for the individuals on the roster, it is the most sensitive fact about them, because it tells an adversary who they are, where they work and what they can do. No rule protects that. Only the customer's own security program can.

What the lender saw on September 30

Chainalysis is private, so its investors do not file. One of its lenders does. Hercules Capital, a business development company listed on the New York Stock Exchange, reports a senior secured loan to Chainalysis, Inc. in its schedule of investments: maturity June 2029, priced at Prime plus 2.95 percent with a 10.45 percent floor. In its quarterly report for the period ended September 30, 2026, filed with the SEC on October 29, Hercules lists principal of $39,413,000, cost of $39,040,000 and fair value of $39,891,000. At December 31, 2025, principal was $36,412,000 and fair value $36,143,000. The loan grew by about $3 million this year and was marked above cost at the end of September.

Nothing in that is wrong. The valuation date preceded an intrusion Chainalysis says it detected in October, and the quarterly report filed the day before the vendor's public notice did not reflect it. We note it for two reasons. First, it is the only public financial instrument that will show whether this incident changes how Chainalysis's creditors see it; the next mark, at December 31, will be filed in February. Second, it is a reminder to sponsors and lenders across software that the "subsequent events" window between a valuation date and a filing date is exactly where an undisclosed security incident lives. A lender that receives a covenant compliance certificate this quarter from any data-platform borrower should ask whether the borrower notified customers of a security incident since September 30.

Questions Chainalysis has not answered

Chainalysis declined The Block's follow-up questions on October 31. These are the questions its notice leaves open. If Chainalysis answers them, this page will say so the same day.

1. On what date did Chainalysis first detect unauthorized activity, and on what date did the first customer notices go out?
2. Was this one intrusion or more than one? The notice uses both "a cybersecurity incident" and "these incidents."
3. Which vulnerabilities were exploited, in which systems, and were they in Chainalysis's own code or a supplier's product?
4. What does "offensive agentic techniques" mean in this case: an autonomous framework, AI-assisted tooling, or something else? Has Chainalysis shared indicators with CISA or with its customers' security teams?
5. How many customer organizations and how many individual users had records accessed? Do the affected organizations include government agencies, and in which countries?
6. What are the "organization role labels," and do they identify which users hold administrative rights?
7. Were password hashes stored for any users, and were they accessed? The notice addresses only "passwords in clear text."
8. Was any part of the FedRAMP-authorized Reactor environment in scope, and if so, when were CISA, FedRAMP and the authorizing agency notified?
9. Is two-factor authentication now mandatory for every user on every Chainalysis product, and if not, when will it be?
10. What is the basis for the conclusion that the incident is unrelated to the Binance theft?
11. Did the WordPress timestamp of 4:14 PM Central on October 30 reflect the moment the notice became public?

What Chainalysis should have done by now

1. Published dates. Detection, containment, first customer notice and second customer notice. A security notice without a single date asks customers to trust the sequence they most need to verify.
2. Stopped calling the data non-sensitive. Name it for what it is to the people affected: a directory of investigators and compliance staff, with roles, that an adversary can use for targeted phishing and impersonation. Then tell them how to protect themselves beyond "be hyper-vigilant."
3. Made two-factor authentication mandatory. Not recommended. Enforced, for every user, with phishing-resistant methods for administrators, and a date by which password-only sign-in stops working.
4. Given each customer its own records the day it was notified. The notice promises a breakdown later. Customers whose administrators were on the list needed that on day one.
5. Told government users which environment was involved. One sentence on the FedRAMP boundary would answer the question every agency security officer is now asking.
6. Published indicators. If an agentic framework was used, the network infrastructure, user agents and timing patterns are useful to every other organization in its customers' sector. Chainalysis's customers are the people best positioned to use them.
7. Answered the follow-up questions. A firm whose business is attribution should be the first to show its work.

What boards should be asking this week

• Do we use Chainalysis, directly or through a vendor, and who in our organization holds an account? Has our security team received the per-organization breakdown Chainalysis promised?
• Did every one of our Chainalysis users have two-factor authentication enabled throughout October? If not, have their sessions and activity been reviewed?
• Have our compliance, BSA, sanctions and investigations staff been told, personally, that an attacker may have accessed their names and roles, and briefed on what targeted approaches look like?
• Which of our other vendors hold a directory of our staff with role labels, and which of them make multi-factor authentication optional?
• Would our vendor contracts require notice of an incident that exposed only our employees' contact data? If not, how would we have learned of this one?
• Did we, or should we, tell our supervisor?

For sponsors and acquirers

Data platforms whose customers are investigators, regulators or compliance teams carry a risk that does not appear in a standard diligence questionnaire: their user directory is itself a high-value target. In diligence on any such company, ask for the user-authentication policy by product and the date multi-factor authentication became mandatory, the list of security incidents notified to customers in the last 36 months with dates, any federal authorization and its incident-reporting history, and whether the company classifies customer user directories as sensitive data. For lenders, add one line to the quarterly compliance certificate: any customer notice of a security incident since the last certificate. The Hercules mark on Chainalysis was made before this incident. Every lender to a data platform should make sure its next mark is not made in ignorance of one.

What we are not saying

We are not saying any investigation content, case file, query result, credential or session token was accessed; Chainalysis says it has found no evidence of that, and we have no evidence otherwise. We are not saying North Korea, Storm-0940, Vapor Panda or any named actor was responsible; no one has attributed the intrusion. We are not saying the Chainalysis incident is connected to the Binance theft; Chainalysis says it is not. We are not saying any government agency, bank or exchange was affected; Chainalysis has not named any customer. We are not saying Chainalysis missed any reporting deadline; we do not know when it detected the intrusion or whom it told. We are not saying chainalysis.org or any other domain is malicious; we are saying it is not under the company's apparent control. We are not saying Hercules Capital's valuation was wrong.

We are saying that a company whose customers include law enforcement agencies, exchanges and financial institutions told those customers that an attacker accessed the names, email addresses and role labels of their users, called that data non-sensitive, gave no date, and recommended rather than required two-factor authentication, in the same week its own research attributed the largest theft in the history of digital assets to North Korea, whose actors, the FBI says, begin by researching people. Chainalysis says the two events are unrelated, and we have not connected them. If Chainalysis would like to correct any of that, this page will be updated the same day.

Our record of these incidents

• Chainalysis Security Incident 2026, the verified timeline and running list of unknowns
• One Stolen Key. 300+ Companies' Email. ConnectWise 'Cannot Determine' Whose., the October intrusion Microsoft attributed to an actor using an agentic framework
• PwC Won't Name the Vendor. Everest's Screenshot Does. It Says Staging., another vendor system holding a firm's staff records
• Bank of America Brought In 1,000 Contractors to Fix What AI Found., the defender's side of AI-speed vulnerability discovery
• Bybit Hack 2025, the last record theft attributed to TraderTraitor

Sources

• Chainalysis Team, Chainalysis, Chainalysis Security Incident Information, October 30, 2026
• Zack Abrams, The Block, Chainalysis says hacker using 'offensive agentic techniques' accessed its customers' names and emails, October 31, 2026
• BleepingComputer, Chainalysis discloses data breach from "offensive agentic techniques", October 31, 2026
• Angel Di Matteo, DiarioBitcoin, Reportes en X señalan una presunta brecha de seguridad en Chainalysis, October 30, 2026
• Michael Millard, Cointelegraph, Blockchain investigator Chainalysis hit by cybersecurity incident, October 31, 2026
• Ravie Lakshmanan, The Hacker News, Chainalysis Confirms Intrusion Into Internal Tools and Exposure of Customer Identity Data, October 31, 2026
• Chainalysis, Company, accessed November 1, 2026
• Rita Liao, TechCrunch, Crypto forensics startup Chainalysis raises $170M at $8.6B valuation, May 10, 2022
• Danny Nelson, CoinDesk via Yahoo Finance, Inside Chainalysis' multimillion-dollar relationship with the U.S. government, February 10, 2020
• Ezra Reguerra, Cointelegraph, Chainalysis sues US over ICE's sole-source contract with TRM Labs, August 17, 2026
• FedRAMP Marketplace, Chainalysis Reactor (FR2334756650), accessed November 1, 2026
• FedRAMP, Incident Communication (legacy CSP playbook), June 24, 2026
• UK Digital Marketplace, Chainalysis Reactor with Data Solutions (G-Cloud listing), accessed November 1, 2026
• Federal Bureau of Investigation, I-090324-PSA, North Korea Aggressively Targeting Crypto Industry with Well-Disguised Social Engineering Attacks, September 3, 2024
• Adam Weidemann, Google Threat Analysis Group, New campaign targeting security researchers, January 25, 2021
• Microsoft Threat Intelligence, AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise, October 21, 2026
• CrowdStrike Counter Adversary Operations, VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign, October 29, 2026
• Anthropic, Disrupting the first reported AI-orchestrated cyber espionage campaign, November 2025
• Elliptic, The Binance hack is laundering on autopilot, October 31, 2026
• Chainalysis, The $6.4 Billion Binance Hack: Tracing the North Korea Link, October 30, 2026
• Al Jazeera Staff and Reuters, Al Jazeera, FBI blames North Korea for record $6.3bn crypto heist from Binance, November 1, 2026
• Joseph Cox, 404 Media, Hackers Target Company That Vets Police Data Requests for Tech Giants, October 19, 2023
• Brian Krebs, KrebsOnSecurity, FBI: Spike in Hacked Police Emails, Fake Subpoenas, November 9, 2024
• Zack Whittaker, TechCrunch, Mandiant: hackers stole significant volume of data from Snowflake customers, June 10, 2024
• Zoltan Vardai, Cointelegraph, Chainalysis leak on Monero traceability, September 9, 2024
• ForkLog, Leaked slides reveal Chainalysis investigators' methods, September 22, 2021 (citing CoinDesk)
• Hercules Capital, Inc., Form 10-Q for the quarter ended September 30, 2026, filed October 29, 2026; and Form 10-K for 2025, filed February 12, 2026
• Ransomware.live, victim search, "chainalysis", checked November 1, 2026 1:04 AM CST