# Chainalysis says an attacker using agentic techniques accessed its systems; customer user names, emails and roles exposed · pwn.watch > Blockchain analytics firm Chainalysis said on Oct 30 2026 that this month it detected an external actor using offensive agentic techniques to gain unauthorized access to Chainalysis systems and internal tools. Some non-sensitive customer data was accessed: user IDs, full names, email addresses and organization role labels for users provisioned on its platform. Based on evidence so far, it found no indication of unauthorized access to investigation content (graphs, notes or cases), transaction or query results, clear-text passwords, MFA secrets or user session tokens. Chainalysis says it is patching the exploited vulnerabilities with outside experts, has notified all customers and will give each organization a breakdown of its accessed records. It says the incident is not related to the recent Binance crypto theft. Page: https://pwn.watch/i/chainalysis-internal-systems-unauthorized-access-oct-2026 · generated 2026-10-31T00:40:58.390Z ## Status - Severity: medium · status: live · patch: partial - Product: Chainalysis blockchain analytics platform - Started: 2026-10-30 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/chainalysis-internal-systems-unauthorized-access-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/chainalysis-internal-systems-unauthorized-access-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/chainalysis-internal-systems-unauthorized-access-oct-2026.json - This file: https://pwn.watch/i/chainalysis-internal-systems-unauthorized-access-oct-2026/llms.txt ## Updates (newest first) - 2026-10-30: Chainalysis publishes a security incident notice: this month it detected an external actor using offensive agentic techniques to gain unauthorized access to its systems and internal tools. It says user IDs, full names, email addresses and organization role labels of provisioned users were accessed, but it has found no indication of access to investigation content, transaction or query results, clear-text passwords, MFA secrets or session tokens. It says it has notified all customers and that the incident is unrelated to the Binance theft. (https://www.chainalysis.com/blog/security-incident-october-30/) ## Fix brief # Security brief: Chainalysis says an attacker using agentic techniques accessed its systems; customer user names, emails and roles exposed Source: https://pwn.watch/i/chainalysis-internal-systems-unauthorized-access-oct-2026 · status: live · severity: medium · updated Oct 30, 2026, 21:56 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Blockchain analytics firm Chainalysis said on Oct 30 2026 that this month it detected an external actor using offensive agentic techniques to gain unauthorized access to Chainalysis systems and internal tools. Some non-sensitive customer data was accessed: user IDs, full names, email addresses and organization role labels for users provisioned on its platform. Based on evidence so far, it found no indication of unauthorized access to investigation content (graphs, notes or cases), transaction or query results, clear-text passwords, MFA secrets or user session tokens. Chainalysis says it is patching the exploited vulnerabilities with outside experts, has notified all customers and will give each organization a breakdown of its accessed records. It says the incident is not related to the recent Binance crypto theft. Severity detail: Confirmed unauthorized access to internal systems and tools; exposed customer data limited so far to user IDs, names, emails and role labels; number of affected users not disclosed - Product: Chainalysis blockchain analytics platform ## Affected versions - Not specified in the data. Check the advisories below. ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes There is nothing for customers to patch. Chainalysis users should expect targeted phishing, treat unexpected password reset requests or authentication prompts with suspicion and enable two-factor authentication. Re-check the Chainalysis notice for affected-record counts and the vulnerabilities exploited; close once the investigation reports and things go quiet. ## Latest updates - Oct 30, 2026: Chainalysis publishes a security incident notice: this month it detected an external actor using offensive agentic techniques to gain unauthorized access to its systems and internal tools. It says user IDs, full names, email addresses and organization role labels of provisioned users were accessed, but it has found no indication of access to investigation content, transaction or query results, clear-text passwords, MFA secrets or session tokens. It says it has notified all customers and that the incident is unrelated to the Binance theft. ## Advisories - [Chainalysis Security Incident Information](https://www.chainalysis.com/blog/security-incident-october-30/) (Chainalysis) ## Write-ups & news - [Chainalysis Security Incident Information (discussion)](https://news.ycombinator.com/item?id=50310615) --- Machine-readable: https://pwn.watch/i/chainalysis-internal-systems-unauthorized-access-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.