Chainalysis Breach Shows AI-Driven Attacks Are Hitting Real Targets

US blockchain analysis firm Chainalysis has confirmed a cybersecurity incident in which an external actor gained unauthorised access to its systems and internal tools. The company said the attacker used "offensive agentic techniques", which suggests an AI-powered tool was involved, though Chainalysis gave no details on the methods used.

The data accessed was described as non-sensitive: user IDs, full names, email addresses and organisation role labels for users on its platform. Chainalysis said the breach did not result in access to its investigation content, authentication credentials or session tokens. The company said it is patching vulnerabilities and hardening its systems, and that it is seeing an industry-wide rise in AI-driven attacks.

The incident comes as attackers increasingly use AI to automate stages of the attack lifecycle and target hundreds of organisations across multiple industries. The source points to a China state-backed group called Vapor Panda, which reportedly used an agentic penetration testing framework called ARTEX to compromise about 140 targets in 11 days. Abnormal AI noted that AI mainly improves established attacks by making them faster, more personalised and easier to scale.

Even data described as non-sensitive, such as names, emails and job roles, can be useful to attackers who want to make follow-up messages more convincing.