Chainalysis, the company that governments and exchanges rely on to trace stolen crypto and catch money launderers, has confirmed it was hit by what it calls a "multifront cyberattack." The fallout is as bad as it sounds: names, usernames, password hashes, and live session tokens for every customer account were exposed. The company has pulled its flagship Reactor tool and Data Solutions platform offline while it investigates.

The attack reportedly involved AI agents and an on-path interception component — essentially, the attackers sat in the middle of live traffic and grabbed tokens as users authenticated. Live tokens are the worst-case credential to lose: unlike passwords, they don't need to be cracked. If an attacker grabs one before it expires, they can walk straight into an account.

Why this matters well beyond one company. Chainalysis isn't just another SaaS vendor. Its Reactor platform is the tool of choice for law enforcement agencies across the US, Europe, Japan, and Australia — including the Australian Federal Police and AUSTRAC — when they're tracing stolen crypto, investigating ransomware payments, or building cases against exchanges. If investigation data was accessed (Chainalysis says it has found no evidence of this yet, but the investigation is ongoing), that could expose ongoing cases, tip off targets, and compromise prosecutorial strategies.

The timing is particularly awkward. Chainalysis was already managing reputation pressure after the $6.3 billion Binance heist last month exposed gaps in real-time blockchain monitoring. Now its own systems are the breach story.

The AI-agent element of the attack is worth pausing on. Defenders have been warned for two years that adversaries would use agentic AI to run co-ordinated, multi-vector attacks faster than human operators can respond. This appears to be a documented example of that in the wild — not a proof-of-concept, but an operational attack against a hardened target.

What to watch. First: whether Chainalysis can confirm that investigation data stayed clean. The company's customers include some of the most sensitive law enforcement operations in the world, and even the uncertainty here creates problems. Second: watch for credential-stuffing attempts against exchanges, analytics platforms, and law enforcement portals using the harvested hashes and any tokens that weren't rotated quickly enough. Third: expect regulatory scrutiny — in Australia, Chainalysis customers in the financial sector may face questions from AUSTRAC about vendor risk management under AML/CTF obligations.

For security teams right now: if your organisation uses Chainalysis products, treat all credentials and tokens as compromised, rotate immediately, and check your logs for anomalous access in the window before the company's disclosure. Don't wait for Chainalysis to tell you which tokens were actually used.