Chainalysis, the blockchain analytics company, admitted on the evening of 30 October 2026 that it had been hacked. According to Journal du Coin, the attacker viewed the names, email addresses and job titles of users at its client organisations. The company attributes the intrusion, detected in October, to "offensive agentic techniques", in other words to artificial intelligence (AI) agents. The admission came a few hours after it attributed the hack of Binance, the world's largest cryptocurrency exchange, to North Korea.
Chainalysis, the company that tracks stolen funds
Chainalysis sells blockchain investigation software. According to Journal du Coin, its tools are used by government agencies, police forces, exchanges and banks. Users keep investigation graphs, notes, case files and query results there, according to the email sent to clients.
The company also publishes research. In the North American section of its annual crypto adoption report, covered by 2clics on 19 October 2026, it counted more than 138 million transactions settled by AI agents on the Base blockchain in the third quarter of 2026. The company that measures AI agents now says it has been targeted by them.
Chainalysis is also at the heart of the Binance case. On 29 October 2026, the exchange confirmed the theft of around $6.3 billion, detailed in our article on the Binance hack. According to Reuters, cited by ICTjournal, Chainalysis recognises a North Korean modus operandi in it. According to Journal du Coin, its teams are still tracking the $6.4 billion that left Binance, of which $2.8 billion has already been frozen: estimates vary from source to source.
What leaked at Chainalysis: facts and statements
Chainalysis is communicating through two channels, which do not offer the same level of detail. Its official statement, published on 30 October 2026 at 22:14 (Paris time), runs to four sentences. It refers to an incident "similar to that of many other tech platforms in recent weeks". The email sent to clients, made public by the X account International Cyber Digest and cited by the website Blockchain.News, says more.
| Item | What Chainalysis says | Status |
|---|---|---|
| User IDs, full names, email addresses, job titles within the client organisation | Viewed, described as "non-sensitive" | Acknowledged by the company |
| Investigation graphs, notes, case files, query results | No trace of access | Company statement |
| Plaintext passwords, two-factor authentication secrets, session tokens | No trace of access | Company statement |
| Number of users affected | Not published, details promised organisation by organisation | Unknown |
| Link with the theft suffered by Binance | None | Company statement, which nothing contradicts at this stage according to Journal du Coin |
The sources consulted cite no independent verification of this scope. Chainalysis has notified all its clients. It is asking them to enable two-factor authentication and to be wary of any unexpected password reset request.
An attack by AI agents: what does that mean?
An AI agent is an artificial intelligence model connected to external tools, which it operates on its own. The MCP (Model Context Protocol) standard is often used for this connection. In crypto, such agents already operate entirely legally: since 11 June 2026, Coinbase has allowed AI trading agents to place orders on its clients' accounts.
Chainalysis does not say what the attacker's agents did, nor how it detected them. The phrase "offensive agentic techniques" therefore remains the company's own characterisation, not a publicly demonstrated fact. Journal du Coin interprets it as AI agents launched against its systems.
The offensive use of AI has been described elsewhere. On 22 October 2026, Check Point Research presented "antidetect" browsers connected to language models, which are used to create thousands of fake profiles. According to its researchers, these tools make it possible to "remove the human operator from the execution phase". Defence is taking the same path: to close its gaps, Chainalysis says it is in turn deploying language models that comb through its systems.
Why names and job titles interest fraudsters
Chainalysis describes the data viewed as "non-sensitive". Journal du Coin disputes that word, and its argument rests on the client base. A list that links a name, a work address and a job title such as "investigator" or "compliance officer" makes tailor-made phishing possible.
The technique is well known. According to an alert published as early as 2022 by CISA, the US cybersecurity agency, the North Korean group TraderTraitor sends fake job offers to employees in the crypto sector. TRM Labs, a blockchain analytics company, names the same group for the Binance theft. However, nothing establishes a link between TraderTraitor and the intrusion at Chainalysis.
A recent precedent shows how it works. Keystone, a hardware wallet manufacturer, disclosed on 24 October 2026 a leak of data on 25,964 buyers. 2clics drew a lesson from it at the time: a name, an address and the details of an order are enough to make a fraudulent message credible. On 23 October 2026, Changpeng Zhao, the former head of Binance, also pointed out on X that data leaks already fuel phishing.
Chainalysis is not the only one affected. According to Journal du Coin, Polymarket, a prediction market platform, lost $2.65 million on the evening of 29 October through a service provider. The crypto platform Coinbase reported on 28 October a new leak at its analytics provider Amplitude. Neither of them, however, holds the case files of the investigators who hunt down hackers.
What the Chainalysis hack changes in Switzerland
None of the sources consulted says which Swiss platforms or authorities use Chainalysis. Journal du Coin cites types of clients, without countries. The number of Swiss users affected therefore remains unknown.
The obligations that make these tools useful do, however, exist in Switzerland. According to the Swiss Financial Market Supervisory Authority (FINMA), cryptocurrency trading, wallets and payment services fall under the Anti-Money Laundering Act (AMLA). These intermediaries must join a self-regulatory organisation and identify beneficial owners. FINMA considers the risks to be particularly high in a decentralised system where assets circulate anonymously. The full framework is set out in our page on FINMA and cryptocurrencies.
Some activities also require a FINMA crypto licence. For supervised institutions, the FINMA travel rule adds a further rule: information about a crypto transfer travels with it, as with a conventional bank transfer. Our analysis: these due diligence obligations explain why blockchain analytics tools matter to Swiss players, and therefore what is at stake in a leak at their supplier.
For an investigator or compliance officer at a Chainalysis client, the immediate risk is a targeted message. The Federal Office for Cybersecurity (FOCS) advises never clicking on the link in an access alert received by email and typing the service's address yourself. It also recommends two-factor authentication wherever possible, as Chainalysis is asking its clients to do.
Data leaks are also on the rise in Switzerland. The Federal Data Protection and Information Commissioner (FDPIC) has received 455 data breach notifications since the start of 2026, compared with 343 for the whole of 2025. AI is also worrying businesses: according to the study "Cybersécurité des PME 2026", 81% of Swiss SMEs expect an increase in AI-related cyber threats, but only 29% are planning additional measures.
For the authorities, blockchain analysis is only one step. The Council of Europe protocol signed on 14 October 2026 in Strasbourg aims to speed up the freezing and confiscation of crypto of criminal origin. Spotting transactions is not enough: the funds must also be immobilised. Switzerland is not among the first signatories listed, and its position is not known.
What we do not know yet
- The number of users and organisations affected, which Chainalysis promises to detail organisation by organisation.
- What the "offensive agentic techniques" actually involve and how the company identified them.
- The exact date of the intrusion, which the company has only placed in October.
- Whether the other platforms affected "in recent weeks" were hit by the same method: Chainalysis draws the parallel without naming them.
- Whether Swiss users are among the organisations concerned.
Sources
- Journal du Coin: « Hack crypto : Chainalysis piratée en pleine traque des milliards volés à Binance », 31 October 2026
- 2clics.com: « Agents d'intelligence artificielle : 138 millions de paiements x402 sur Base selon Chainalysis », 19 October 2026
- 2clics.com: « Hardware wallet Keystone : clé d'authentification volée, clients exposés », 28 October 2026
- 2clics.com: « Fraude en ligne : des navigateurs antidetect dopés à l'IA », 24 October 2026
- 2clics.com: « Sensibilisation à la cybersécurité des employés : méthodes pour PME », 27 October 2026
