POPA ReconYes. Chainalysis confirms it was hacked.
Its own incident page, Chainalysis Security Incident Information, says an external actor gained unauthorized access to its systems and internal tools. Accessed data was non-sensitive customer data: user IDs, full names, email addresses and organization role labels. It says it found no evidence of access to investigation graphs, notes or cases, transaction or query results, clear-text passwords, MFA secrets or session tokens.
The customer email first surfaced via @IntCyberDigest, which described the method as "offensive agentic techniques" and said Chainalysis told customers the incident is unrelated to the $6.3B Binance heist. That same wording was widely reposted, including by @PabloSabbatella warning of more phishing and by @DarkWebInformer.
Chainalysis says it hired outside cybersecurity experts, is still determining which records per organization were accessed, and urges users to watch for unexpected password resets and enable two-factor authentication.