Chainalysis Reports Hack Involving AI Agents and Data Theft
Chainalysis says attackers used AI agents to steal customer data, but not passwords or session tokens. The company points to North Korea in a string of recent crypto hacks.
Key Takeaways
- Chainalysis says an attacker used AI agents to access parts of its systems and steal customer data.
- The stolen data includes names, email addresses, user IDs, and job titles; case files, passwords, and session tokens were left untouched.
- Chainalysis points to North Korea and says criminals are increasingly using AI for faster, large-scale attacks.
Chainalysis says that an attacker used AI agents to gain access to parts of its systems and steal customer data in the process. That includes names, email addresses, user IDs, and job titles of the company’s customers, which include banks, crypto exchanges, and government agencies. According to Chainalysis, case files, passwords, login codes, and session tokens were not affected.
What Was Stolen
The company said Friday that the attacker got in through so-called offensive agentic techniques. By that, Chainalysis means software that can plan and carry out tasks step by step without needing a person involved every time. The company did not say how much of the breach was carried out entirely by AI.
Chainalysis calls the stolen information non-sensitive, but the mix of names and job titles could still help with targeted phishing or other focused attacks. The company says teams are working around the clock on the investigation, closing vulnerabilities, and strengthening its systems.
Why This Stands Out
The hack fits into a broader trend where criminals use AI to carry out attacks faster and at larger scale. Earlier this year, it also became clear that an attacker using AI agents was able to break into more than 100 company websites by independently finding weak spots and carrying out intrusions. For crypto companies, that is especially sensitive because they often combine a lot of customer and transaction data in one environment.
Link to North Korea
Chainalysis itself works to track down crypto thieves, and in this case the company points to North Korea. CEO Jonathan Levin said that DPRK, in his view, is “using their old tricks again.” The timing stands out because Binance said this week that its own investigation into a record $6.3 billion (€5.6 billion) theft leads back to a compromised laptop belonging to one engineer.
North Korea has also played a major role in earlier crypto breaches. The Lazarus Group and other state-backed hackers have long been linked to major thefts, including the 2025 Bybit hack worth $1.5 billion (€1.3 billion). The United Nations has also started investigating these kinds of attacks, partly because earlier reports say the stolen funds can be used for North Korea’s weapons program.
