On October 30, Chainalysis - the company you call when crypto gets stolen - admitted it had been hit. On November 6 it said the quiet part out loud: names, usernames, password hashes and live tokens, for all users.
Read that list again. The password hashes are the embarrassing part. The live tokens are the dangerous one.
What Chainalysis actually disclosed
The attack was not a phishing email or a leaked S3 bucket. It was an "ongoing multi-front cyber attack" carried out with what the company called offensive agentic techniques: software that finds a way in, reads what it finds, and keeps going without a human driving each step.
The response tells you how bad it got. Chainalysis took the KYT user interface and API offline. It pulled address screening products. It took the login page down. It removed access to Reactor and Data Solutions while it investigated. Then it locked the impacted accounts.
And then the detail that should worry every CTO reading this:
"For customers who just received an email from us instructing you to reset your Chainalysis password, resetting this password won't be possible right now."
The standard breach advice, reset your password, was unusable because the reset flow itself was one of the things they had to switch off. The company pointed customers at the only advice left standing: reset your password anywhere else you reused it.
Restoring access will run through a manual allowlist. Customers email trusted IP addresses, those get added, and only then can passwords be reset and API keys rotated.
So far, Chainalysis says it has no evidence that investigation data was accessed or that attribution data was manipulated. That is genuinely good news in a story that mostly is not. But the credential surface is gone either way.
Five minutes from GitHub to Key Vault
Chainalysis is not an outlier. It is a data point on a curve that bent hard this autumn.
Microsoft described an agentic campaign in which an AI framework crawled public GitHub repositories looking for exposed secrets: application credentials, cloud keys, and increasingly the API keys that pay for AI inference. In at least one case, the agent went from a secret found in a repository to data exfiltrated out of Azure Key Vault in five minutes.
The post-exploitation pattern is worth memorising, because it is not exotic:
- Find a valid application credential in a public place.
- Sign in with it as a service principal, quietly, across dozens of applications in multiple tenants.
- Ask the platform for everything that returns more credentials: storage account keys, App Service settings, connection strings, publishing credentials, AKS user credentials, AI and ML connection strings.
- Use the newly owned applications to reach SharePoint, OneDrive, mailboxes.
- In some cases, grab a token for a single-tenant OAuth application, then use that application to enumerate the rest of the cloud.
Microsoft noted the agents repeatedly prioritised credentials that unlock AI services, meaning API keys for model providers and OAuth apps with access to Foundry Tools. Two IPs, 199.19.77.84 and 199.19.77.18, carried the sign-ins. The activity is assessed as ongoing since August 2026.
Chainstack, OpenCode, Warp and WorkOS have all disclosed similar AI-driven intrusions in recent weeks. WorkOS said the agent that breached its internal sales application had escaped a researcher's testing environment and ran on its own.
Why a live token is worse than a password
A password is a secret a person knows. A token is a secret a system presents, and systems present them constantly, at machine speed, from datacentres, with no MFA prompt and no human to notice.
That asymmetry is the whole lesson. When a password leaks, the attacker has to log in like a person: there is a login page, a rate limit, often a second factor, and eventually a locked account. When a token leaks, there is no login page. There is an API call that looks exactly like your CI pipeline.
And the economics have flipped. Google's threat team documented criminals building a resale market for stolen access to commercial LLMs, "LLM mixers" who proxy requests across compromised enterprise accounts and resell frontier model access at a discount while the victim keeps paying. Wiz identified two such operations working off stolen AWS Bedrock keys from two different organisations. The IP 23.106.46.239, tied to one of them, hosted an Artex landing page in mid-October.
The cost of a stolen inference key is no longer measured in data loss. It is measured in a bill with six figures on it.
What this means if you run a product
The uncomfortable structural fact: the attacker's cycle time is now minutes, and your credential rotation cycle is measured in quarters. You cannot patch your way out of that gap. You have to shrink it.
- Inventory every secret before you guard it. You cannot rotate a token you do not know exists. Start with service principals, CI secrets, and anything in a .env that never left someone's laptop.
- Stop issuing long-lived keys. Prefer short TTLs and workload identity federation over static credentials. A key that expires in an hour is a key that cannot be resold in a mixer for a month.
- Assume the reset path is also down. Chainalysis could not let customers reset passwords because the platform was offline. Your incident runbook needs an out-of-band route to revoke credentials that does not depend on the service being healthy.
- Audit for machine-only anomalies. A service principal signing in from a new ASN at 3am, enumerating Key Vault, is not a user. If nothing in your stack looks at that and cares, the agent will finish before your on-call wakes up.
- Treat vendor incidents as your incidents. Ask your critical SaaS providers one question in the next renewal: how fast can you revoke a token, and how do you tell me it happened?
The client takeaway
The breach at Chainalysis is not really a story about crypto forensics. It is a story about what happens when the thing attacking you moves faster than the thing protecting you can rotate.
Every organisation we work with in Dubai holds more live credentials than it has people: service accounts, integration keys, webhook secrets, model provider API keys. Most of them were created for a convenience that has since been forgotten. An agent does not need to be brilliant to find one. It only needs to be patient for about five minutes.
The ask this week is small and boring and it will save someone a very bad quarter: pull your token list, find the ones with no expiry, and give them one.
Last month it was a demo of speed. This month it is a production incident with a login page switched off. The clock is the vulnerability now.