Cryptocurrency: attacks on Chainalysis, the blockchain analytics giant
The company has reported unauthorised access to its systems. Here is what MiCAR-authorised crypto-asset service providers need to do to protect themselves
Cryptocurrency: the attack on Chainalysis serves as a reminder to boards of directors to prioritise security.
Even providers of anti-money laundering tools for cryptocurrencies are vulnerable to cyber-attacks. On 30 October 2026, Chainalysis – one of the best-known names in blockchain analysis – reported unauthorised access to its systems: this involved users’ names, email addresses, identifiers and roles. The company reports that offensive techniques based on artificial intelligence agents were used. At this stage of the investigation, there is no evidence of access to investigative data, plaintext passwords or session tokens. This incident is distinct from the theft of approximately $6.3 billion reported by Binance.
A further risk is the use of that data to create credible requests, targeted specifically at those responsible for managing controls and confidential information. Chainalysis recommends two-factor authentication and caution regarding unexpected requests to change passwords or verify identity.
For MiCAR-authorised crypto-asset service providers, both Italian and European, the issue concerns governance. DORA (EU Regulation 2022/2554, the Regulation on digital operational resilience and the management of ICT risks in the financial sector) requires the management of ICT risk, the protection of data and the oversight of technology providers. Responsibility remains with the management body even when services are outsourced.
Board members with expertise in compliance and anti-money laundering should promote formal guidelines from the Board of Directors to the relevant departments and ensure coordination between the AML, cyber security and data protection functions. The procedures should provide for verification via previously verified contact details, separate from those indicated in the request; dual authorisation for the transmission of sensitive data; the transmission of only the necessary data via secure channels; access restricted to operational requirements; and the tracking of accesses and alerts regarding anomalous data retrievals.
