chainalysis said no passwords leaked. 5 days later: all its users

daily ai × crypto news in 5 minutes. no hype, just what matters.

evening. tonight the hacked company is the one that usually explains hacks to everyone else. chainalysis, the blockchain analytics firm police and exchanges use to trace stolen crypto, rewrote its own breach story in five days: from "no passwords, no tokens" to password hashes and live tokens for all users. also tonight: openai's ai wrote 948 working linux root exploits, india warns of an ai-assisted gang draining fintechs and crypto exchanges, and a fed president talks about ai agents paying in stablecoins.

day one: "non-sensitive". on oct 30, chainalysis said "an external actor using offensive agentic techniques" had gained unauthorized access to its systems and internal tools earlier in the month. it said it found no evidence of access to investigation content, clear-text passwords, mfa secrets or user session tokens. only "non-sensitive" data, such as user ids, full names, emails and role labels, was taken. it also said the incident was unrelated to the binance theft we covered in #021. (chainalysis)

five days later: all users. the update posted nov 4 at 11:00 pm est says that on monday (nov 2) chainalysis discovered "names, usernames, password hashes and live tokens for all chainalysis users were exposed to a malicious actor." a password hash is a scrambled version of a password; weak ones can sometimes be cracked back. a live token can let someone into an account without a password at all. chainalysis says it still has "no evidence that any investigations data has been accessed or chainalysis attribution data has been manipulated." (chainalysis)

then the screener went dark. nov 4 brought three updates. at 9:50 am est it emailed some customers that an "on-path attack" (someone sitting between users and the service) had exposed their passwords. at 10:30 am, "abnormal activity" made it take kyt (its ui and api), other address-screening products and its login page offline. by night it was notifying customers whose kyt accounts "appear to have been accessed without authorization." kyt is the tool exchanges use to flag dirty money moving through them. reactor (its investigations tool), data solutions and chain (beta) were already offline since monday. (chainalysis)

what's still unknown. chainalysis says it serves more than 1,500 customers across law enforcement, crypto, finance, regulators and national security, but hasn't said how many users it has. the record notes it never explained "offensive agentic techniques" or "live tokens", didn't say how the hashes were made, didn't say whether the password interception, the leak and the account access were the same attacker, and didn't explain how customers screened transactions while kyt was off. it also never said an ai agent caused the breach, only that one was used as a technique. (the record)

the fix. kyt and address screening start coming back today (nov 5), but only for customers who send trusted ip addresses for an allowlist. every user will have to reset passwords and rotate api keys, and chainalysis warns users to go to its login page directly rather than click links in reset emails, a classic phishing moment. no date yet for reactor or data solutions. (chainalysis)

why it matters. chainalysis data sits underneath a lot of crypto's compliance and many police investigations, so even with no case data touched, this is a trust story. the pattern is the one we flagged in #022 with gitbook: "ai agents" show up in the first notice, the real damage shows up in later updates. if your company uses chainalysis: reset from the official login page, rotate every api key, and treat any "reset your password" email as suspect. more in crypto.

openai's ai wrote 948 working linux root exploits for $1,279 each. in a nov 4 post, openai described an autonomous pipeline with an unreleased "cyber model" that, in a mid-october run, reproduced 1,724 linux kernel vulnerabilities and produced 948 unique local privilege escalation exploits, ways for an ordinary local user to become root, on a stock desktop distribution. the run cost $1,213,430 in api credits, or $1,279 per exploit, and drafted a patch for each. openai values the haul at a hypothetical $18.9m–$66.3m using old pwn2own and typhoonpwn bounties. (openai, the hacker news)

the crypto angle: about two-thirds of ethereum nodes run linux, per ethernodes.org data cited by coindesk. but these are local bugs: the attacker needs an account on the machine first, so this is "patch your servers", not "ai can hack every node". polygon labs cto mudit gupta told coindesk that client and infrastructure diversity makes crypto "much more resilient to bugs like this". the results are openai's own and the model isn't public. same direction as #017, where an ai scan found real bitcoin core bugs. (coindesk)

india: an ai-assisted gang is draining fintechs and crypto exchanges, and comes back after the patch. india's cert-in, in a nov 4 advisory, named a previously undocumented actor, "crafty falcon", hitting lending apps, fintechs, payment aggregators and crypto exchanges, which have reported repeat attacks after "incomplete remediation" of an october warning. it gets in through exposed test and staging servers, jumps to production via shared credentials, sends ₹1 test transfers before large ones, and strikes on holidays and weekends. at crypto exchanges, it steals wallet keys and siphons funds. (infosecurity magazine, cert-in advisory)

the "ai" is off-the-shelf: public offensive tools like artex (built on the pentagi multi-agent framework), cyberstrikeai and cairn, plus scripts that look ai-generated. infosecurity notes earlier campaigns using these tools were linked to china-based actors; mint calls the gang china-linked, but we didn't see that attribution in the advisory text. no victims or amounts were named. cert-in's advice includes keeping wallet keys in hardware security modules or cold custody, not in internet-connected hot wallets. (infosecurity magazine, mint)

a fed president on ai agents paying in stablecoins. in zurich today (nov 5), cleveland fed president beth hammack said stablecoins may have technological advantages "such as the ability to execute smart contracts or to enable agentic workflows", which may raise demand for stablecoins "and thus for us dollar assets", likely treasury bills. but "current us regulation does not directly address use of smart contracts or agentic ai for payments," and without clarity "us institutions may be slow to adopt." (cleveland fed)

she stayed skeptical of crypto itself: price volatility makes it "a less certain store of value than the dollar", and she has "yet to see compelling evidence of broad use cases" as money. she also noted new us federal stablecoin rules under the genius act take effect in january. for how agents actually pay today, see our x402 guide. (cleveland fed)

metasleuth: blocksec's visual fund-tracing tool. paste an address or transaction and it draws where the money went across bitcoin, ethereum, solana, tron and other chains, with address labels and paths to exchanges and mixers; you can also set alerts on an address. free plan ($0, 200 basic investigations a month); paid plans from $30/month (pricing). for anyone who wants to follow stolen or suspicious funds themselves, without an enterprise contract. more picks in the gweiwire tools catalog.

whether kyt comes back cleanly today and whether chainalysis says how many users and kyt accounts were hit; a date for reactor; whether linux maintainers merge openai's patches quickly; and whether cert-in names victims or amounts.

that's the wire. even the detectives get a "reset your password" email. back tomorrow. — gweiwire

forward this to the friend whose job runs on screening tools. new here? subscribe at gweiwire.com. not financial advice.