Chainalysis says names and roles leaked and case files did not

Chainalysis put a customer letter out on Friday, October 31, 2026, at about 5:14 p.m. Eastern, and published the same account as a security notice. The blockchain analytics firm says an external actor reached its systems and internal tools earlier in the month. The wording it chose for the method is “offensive agentic techniques.” The letter does not name a vulnerability, a tool, or a dwell time.

The fields Chainalysis says were accessed are user IDs, full names, email addresses, and the role labels of people provisioned on the platform. A spokesperson confirmed the incident to BleepingComputer and said outside cybersecurity experts are on the investigation. The company is also using large language models in a broader review of its own platform. Chainalysis says the work so far has not shown access to investigation content, authentication credentials, or session tokens, and that this incident stands apart from the Binance theft.

The list that customers still do not have is the one that matters for notification duties. Chainalysis says it is still sorting which records each organization lost, and that a breakdown will follow when that count is finished. Until the appendix arrives, every provisioned user belongs in the exposed set.

Who the directory is for

Chainalysis sells tracing and investigation tools to law enforcement, government agencies, exchanges, and other financial institutions. The product is the case work. The letter says that product stayed put. What left, on the company’s account, is the seating chart: who has an account, what they are called, where mail reaches them, and which role the tenant assigned.

That seating chart is enough for the next message. Chainalysis is telling customers to turn on two-factor authentication and to watch for unexpected password resets, unexpected sign-in prompts, and strangers posing as the company. It called out two costumes in particular: a fund-recovery pitch, and a recruiting pitch. Role labels tell the sender who is worth the more careful version of either note.

What to do before the per-team list arrives

Turn on a second factor for the Chainalysis account and for the mailbox that receives its notices. Tell staff, in the channel you already use for fraud warnings, that a recovery offer or a job offer invoking the company is hostile until it survives a check you initiate. Send password resets through that same channel. An unexpected prompt is a ticket, not a click.

Ask Chainalysis, in writing, for the per-organization record list when the review finishes, and keep that notice with the incident file. Remove seats that no longer match a current job. A role label for someone who has left is still a name an impersonator can wear.

The missing CVE does not postpone any of that. Chainalysis has said it is patching and hardening. Customers cannot patch a name and an email that have already been read. They can make those fields a poor login, and a poor pretext, by the end of the day.

This briefing relies on public reporting by BleepingComputer and on Chainalysis’s customer disclosure.