Chainalysis is the company law enforcement calls when stolen cryptocurrency needs tracing. Last week somebody got into it. The company has been posting updates to a single page since 30 October, and read in order those updates are a more useful document than any of the coverage of them.

The timeline, as the company tells it

Friday 30 October. Chainalysis says it has been targeted. It also says there is "no evidence of unauthorized access to investigation content, authentication credentials, or session tokens". The intruder is described as having used "offensive agentic techniques" to reach systems and internal tools. The incident is unrelated to the Binance theft.

Monday 2 November. Reactor and Data Solutions are taken offline as a precaution while outside experts assess. The compliance transaction monitoring products stay up.

Wednesday 4 November, 9:50am EST. An on-path attack has exposed a subset of customer passwords. Those accounts are locked.

Wednesday 4 November, 10:30am EST. Transaction screening, the other address screening products and the login page go offline after abnormal activity.

Wednesday 4 November, 11:00pm EST. The sentence the week turns on: "certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor."

Friday 6 November, 3:30am EST. Screening is being restored in phases, gated on customers sending in IP addresses for an allowlist. Reactor and Data Solutions are still being hardened.

Put the first update against the fifth

On Friday the company named three things as clear: investigation content, authentication credentials, and session tokens.

Five days later it confirmed password hashes and live tokens for every user it has.

Two of the three categories it specifically cleared are the two it later confirmed as taken. Only investigation content is still standing, and the company's phrasing on that one is "no evidence", which is the same phrasing it used on Friday about the other two.

This is worth being fair about. An early statement is a snapshot of an investigation that has not finished, and a company that says nothing on day one gets criticised for that instead. But there is a difference between saying little and naming three specific categories as untouched. Naming them is what makes the reversal legible, and it is also what made the first notice reassuring in a way the facts did not support.

There is a second gap inside the same text. The 4 November notice begins "On Monday, we discovered" the full credential exposure. Monday was 2 November. On Monday the public update said Reactor was being taken down as a precaution. The discovery and the disclosure are two days apart.

Why an outage at a vendor stopped other people's withdrawals

Chainalysis sells screening. Exchanges run transactions through it to meet their compliance obligations before releasing funds. If the screening does not answer, a compliant exchange cannot release the funds.

So when the screening products went offline, Coincheck suspended cryptocurrency withdrawals, citing a failure in an external on-chain analytics service, and ICONOMI suspended withdrawals citing Chainalysis directly. Customers of companies that were not breached could not move their own money, because a third company they have no relationship with was having a bad week.

That is the part of this incident with the longest tail. The industry has spent years arguing about custody risk and counterparty risk. This is neither. It is a compliance dependency behaving as a single point of failure, and the market has quietly concentrated it into very few hands.

Meanwhile Reactor, the investigation platform, has no announced reopening date. The tool investigators use to trace stolen funds has been unavailable for most of a week, during the fortnight after the largest cryptocurrency theft on record. Chainalysis has continued publishing attribution work on that theft on the same blog that carries the incident notice.

Offensive agentic techniques

The company's own description of how it was attacked is "offensive agentic techniques". It does not elaborate, and neither will we, because there is nothing further in the primary source to go on.

But note where the phrase appears. A firm whose business is tracking what criminals do with new technology is describing its own intrusion in terms of AI agents, in its first public notice, before it knew the full scope. That is a choice, and it is the kind of sentence that tends to be either very carefully checked or very quickly regretted.

What customers have to do

  • Reset passwords and rotate API keys. The company requires it before access is restored.
  • Send trusted IP addresses in for the allowlist, because access is gated on it.
  • If that password was used anywhere else, change it there too. Password hashes were taken, not just usernames.
  • Treat unsolicited password reset emails as hostile. The company has warned about this specifically, which usually means it is already happening.

What is not established

  • How the attacker got in. The page never says. The 6 November update mentions "exploited vulnerabilities" and names none.
  • Whether the 30 October statement was wrong when it was written or accurate then and overtaken by events. The page does not reconcile the two, and both readings are available.
  • What "offensive agentic techniques" means in practice. We are quoting it, not interpreting it.
  • Whether Chain (Beta) and the login page have been restored. They were offline on 4 November and the page has not said since.
  • Whether investigation data moved. The company says there is no evidence of it, and no evidence that attribution data was manipulated.
  • The Coincheck and ICONOMI suspensions come from secondary reporting. We did not find either company's own notice.