Crypto hack: Chainalysis hacked while tracking billions stolen from Binance

The tracker tracked. Chainalysis admitted on Friday evening that it had itself been the target of a cyberattack, a few hours after attributing the Binance hack to North Korea.

Data from its customers is out. Above all, the company attributes the intrusion to an attacker who launched “offensive agentic techniques” (artificial intelligence agents) against its systems.

The blockchain analysis specialist confirms an intrusion detected in October.

Identifiers, names, email addresses and functions of customer users were consulted.

The investigation files and passwords would have remained out of reach.

The company assures that the attack has nothing to do with the theft suffered by Binance.

Chainalysis hacked: what the attacker was able to see

The official press release, posted online Friday at 10:14 p.m. (Paris time), is in four sentences. Chainalysis speaks of an incident “similar to that of many other tech platforms in recent weeks”. She also claims to have found no trace of access to survey content, authentication credentials or session tokens. The company has notified all its customers.

The email sent to these customers is significantly more chatty. According to extracts published by Blockchain.News, the attacker accessed user IDs, full names, email addresses and role titles within each client organization. Chainalysis, however, describes this data as “non-sensitive”. However, the attacker would not have touched the investigation graphs or the notes, files and query results. No more than plaintext passwords or two-factor authentication secrets.

Chainalysis does not publish the number of affected users. The company promises organization-by-organization detail, asks to enable double authentication and calls for extreme vigilance in the face of any unexpected password reset requests.

Chainalysis leak: a dream directory for targeted phishing

“Non-sensitive”, really? First we need to look at who uses Chainalysis. Its software equips government agencies, police departments, exchanges and banks. However, a list that combines a name, a professional address and a function such as “investigator” or “compliance manager” is exactly what a fraudster dreams of when setting up a tailor-made phishing scheme.

The process is not theoretical. The TraderTraitor group, accused of the Binance theft, has made a specialty of false job offers sent to employees in the crypto sector, according to an alert published in 2022 by CISA (the American cybersecurity agency). For its part, Chainalysis repeats that its incident has no link with Binance, and there is nothing to confirm the contrary today.

The company is not alone in counting its breaches this week. Polymarket lost $2.65 million on Thursday evening via a service provider. Coinbase reported a new leak from its analytics provider Amplitude on Wednesday. But neither of these two keeps the files of the investigators who hunt down the pirates.