Chainalysis, whose software police and exchanges use to trace crypto, says attackers using AI agents reached its customers' staff names and emails

The stories

7 stories on this beat today.

Every story told the same way: what happened, who is involved, why it matters, how it works, the truth and the good news.

1. 01

   Chainalysis, whose software police and exchanges use to trace crypto, says attackers using AI agents reached its customers' staff names and emails

   140

   targets one Chinese state-backed group broke into in 11 days with an AI kit

   it used ARTEX, an AI tool that runs attack steps by itself [2]

   What happened

   • Chainalysis says attackers broke into its systems and internal tools this month. [1]
   • Chainalysis is a US company whose software traces crypto payments. [2]
   • Police, governments, crypto exchanges and banks use it to investigate fraud and ransomware. [1]
   • The attackers reached users' names, email addresses, user IDs and job-role labels. [1]
   • Chainalysis says the attackers used "offensive agentic techniques". [1]
   • Agentic means AI programs that carry out many steps with little human help. [1]
   • Chainalysis has not said which flaws were used or how long the attackers stayed. [1]
   • Chainalysis found no evidence that investigation files, passwords or login sessions were reached. [1]
   • It calls the details reached "non-sensitive customer data". [2]
   • Affected customers were told details of their own organisation and users were reached. [2]
   • Chainalysis says this break-in is not linked to the Binance theft. [1]

   Who is involved

   • Chainalysis a US company whose software traces crypto payments for police, governments, exchanges and banks; it was broken into
   • Police
   • Governments
   • Crypto exchanges
   • Banks
   • Affected customers told their users' details were reached
   • Fake Chainalysis
   • Customers' staff
   • Chainalysis's customers police forces, government agencies, crypto exchanges and banks; their users' names and emails were reached
   • The attackers not named; Chainalysis says they used AI agents to get in

   How it unfolded

   Chainalysis says it is seeing an industry-wide rise in attacks driven by AI. [2]

   A Chinese state-backed group broke into about 140 targets in 11 days with an AI kit. [2]

   1. This month break-in spotted
   2. Friday customers told
   3. Not yet which records, per customer
   4. This month Chainalysis spots an outsider using AI agents inside its systems
   5. Fri 30 Oct it tells customers which kinds of details were reached
   6. Next a breakdown for each customer once its review ends

   Why it matters

   Chainalysis told customers to expect fake password resets and fake login prompts. [1]

   It also warned of scammers posing as Chainalysis, offering to recover lost funds or jobs. [1]

   It asked customers to turn on a second login check, called two-factor authentication. [1]

   The truth

   • What is really going on Attackers this week went after companies that hold other people's details and keys.
   • What is really going on Chainalysis, whose software police use to trace crypto, had its customers' staff names and emails reached by attackers. [1]
   • Why it works on people The word non-sensitive sounds like nothing to worry about, but it only means the data cannot open an account on its own.
   • Nobody has said whether the attackers used an AI kit like ARTEX or their own. [1]
   • Chainalysis is still working out which records were taken for each customer. [1]
   • Until then, customers' staff must watch for fake messages without knowing if they are listed. [1]
   • Who gains Whoever reached Chainalysis's customer list — It names people at police forces, exchanges and banks by role, which is why Chainalysis warns of impersonators. [1]
   • Who pays Chainalysis customers' staff — They were told to watch for fake password resets, login prompts and fake Chainalysis offers. [1]
   • Nobody knows yet

     How the attackers got into Chainalysis, and how long they were inside.

     Chainalysis has not named the flaws, the tools reached or the time the attackers had. [1]

   • Nobody knows yet

     Whose records Chainalysis lost.

     It is still working out which records were reached for each customer, and promises a breakdown later. [1]

   Good news

   • Chainalysis says it is patching the flaws and using AI to review its own security. [1]

   What comes next

   Chainalysis says each customer will get a detailed breakdown when its review ends. [1]

1. 02

   FBI names North Korea; Binance repays 90%

   What happened

   • The FBI, the main US federal police force, said on Saturday that North Korea robbed Binance. [3]
   • Binance, the world's biggest crypto exchange, had about $6.3bn stolen on Thursday. [3]
   • Binance says it has replaced 90% of the stolen coins, using its own money. [4]
   • Part came from SAFU, a $1 billion fund Binance keeps to repay users after hacks. [4]
   • The last 10% is in coins that are harder to buy quickly, Binance says. [4]

   Who is involved

   The FBI named TraderTraitor, a group believed to be part of North Korea's Lazarus Group. [5]

   • FBI
   • North Korea
   • TraderTraitor believed part of the Lazarus Group
   • Binance pays from its own funds
   • Richard Teng Binance co-chief executive

   How it unfolded

   The FBI also blamed TraderTraitor for a $1.5 billion theft from Bybit, another exchange, last year. [4]

   North Korea has always denied taking part in such attacks. [3]

   1. Thursday $6.3bn stolen
   2. Saturday FBI names North Korea
   3. Sunday withdrawals restart

   Why it matters

   The FBI published the thieves' crypto addresses and asked exchanges to block them. [4]

   Blocking them is meant to stop the money being moved to hide where it came from. [6]

   How it works

   Risk managers call a fund like SAFU self-insurance: a firm saving to pay its own losses. [4]

   The truth

   • Binance is paying for the theft from its own funds. [5]
   • Co-chief Richard Teng says users will not bear the financial impact. [5]
   • The FBI expects the stolen coins to be swapped again to hide them. [6]
   • Who gains Binance's users — Binance says it has replaced 90% of the stolen coins from its own funds, so users keep their holdings. [4]
   • Who pays Binance — It set aside more than $6.34bn of company money to cover the theft. [3]
   • Nobody knows yet

     When Binance will cover the last 10% of the stolen coins.

     Binance says those coins are harder to buy quickly and gave no date. [4]

   • Nobody knows yet

     How much of the $6.3bn will be caught before it is hidden.

     The FBI expects the coins to be swapped again to hide them, and has asked exchanges to block the thieves' addresses. [6][4]

   Good news

   • Binance says users' bitcoin, ether and Tether holdings are fully covered. [3]
   • Binance says it has replaced 90% of the $6.3bn in stolen coins with its own money, and its users began withdrawing again on Sunday.

   What comes next

   Binance began letting users withdraw again on Sunday, in stages. [6]

2. 03

   Northflank breach: customers' AI keys used by strangers

   What happened

   • Northflank, a service that runs other companies' apps online, says it was broken into. [7]
   • It told every customer to assume their stored secrets had been unscrambled and stolen. [7]
   • Its warning read: "Assume all environment variables have been decrypted." [7]
   • Several customers then reported strangers using the AI keys they had stored there. [7]

   Who is involved

   Environment variables are settings where apps keep passwords and keys for other services. [7]

   • Northflank runs apps for developers
   • Developers may get bills for AI use they never made
   • Customers change every key themselves

   How it unfolded

   Wiz, a cloud security company, alerted Northflank at 11:43 UTC on 30 October. [7]

   Engineers looked a minute later and sent out fixes at 12:50 and 13:05 UTC. [7]

   Wiz counted at least 9 break-ins at AI developer platforms in October. [7]

   In two cases, stolen logins made about 2.5 million AI requests costing about $100,000. [7]

   1. 11:43 Wiz raises the alarm
   2. A minute later engineers look
   3. 12:50 and 13:05 fixes go out

   Why it matters

   Developers who stored AI keys there may face charges for AI use they never made. [7]

   How it works

   Wiz calls this LLMjacking: using someone else's AI account so they get the bill. [7]

   The truth

   • What is really going on AI keys that developers stored at Northflank were taken and used by strangers. [7]
   • Northflank has not said how attackers got in or how many customers were hit. [7]
   • Customers must change every stored key themselves, Northflank says. [7]
   • Who gains Whoever holds stolen AI keys — They run AI on other people's accounts; in two cases Wiz studied, stolen logins ran up about $100,000 of AI use. [7]
   • Who pays Northflank's customers — They must change every key they stored and check their AI bills for use they never made. [7]
   • Nobody knows yet

     How Northflank was broken into, and how many customers were hit.

     Northflank has not said, and did not answer BleepingComputer's questions. [7]

   • Nobody knows yet

     Whether the nine break-ins at AI developer platforms are one group's work.

     Wiz says many of them went after AI keys, but it has not confirmed one attacker behind them all. [7]

   Good news

   • Northflank turned on activity records for every customer, free accounts included. [7]
   • Northflank's engineers looked at Wiz's warning one minute after it arrived, and the company turned on activity records for every customer, free accounts included.
3. 04

   A single text can crash older Android phones

   What happened

   • A researcher published working attack code for an Android flaw called SMS of Death. [8]
   • The researcher, Mark Blah, says one specially built text can crash a phone's calling system. [8]
   • The crash drops calls in progress, including calls to emergency services. [8]
   • Android reads the message before it reaches the inbox, so the owner sees nothing. [8]
   • In tests, 20 such texts left some phones restarting again and again. [8]
   • One Android 12 phone restarted about every 90 seconds until it was wiped clean. [8]
   • Phones on Android 12 and 13 did not get the fix, he says. [8]
   • The flaw is also missing from Google's October list of fixes. [8]

   Who is involved

   • Android 12 and 13 owners
   • Phone maker
   • Mobile carrier

   How it unfolded

   Google fixed the flaw in October updates for Android 14 to 17, the researcher says. [8]

   Why it matters

   Owners of older Android phones stay open to a crash they cannot see coming. [8]

   How it works

   The text carries a length number, and Android used it without checking it. [8]

   Programmers call that check input validation: testing what a sender claims before trusting it. [8]

   The truth

   • Whether a phone gets the fix depends on its maker and its carrier. [8]
   • Who pays Owners of Android 12 and 13 phones — The researcher says they have no fix for a text that can drop their calls, emergency calls included. [8]
   • Nobody knows yet

     Whether Android 12 and 13 phones will ever get a fix for SMS of Death.

     The researcher says they did not get Google's October fix, and the flaw is not on Google's October list. [8]

   Good news

   • Google's fix stops the crash and deletes the bad messages from the phone. [8]
   • Google's October fix for Android 14 to 17 stops the SMS of Death crash and deletes the bad messages from the phone.

1. 05

   Malware asks AI what each victim is worth

   What happened

   • Cisco Talos, a security research team, found password-stealing malware that asks AI to judge its victims. [9]
   • The malware calls itself Volta-Autodoxer, Talos found. [9]
   • It takes saved passwords, login cookies, payment cards and crypto wallet phrases. [9]
   • It also takes logged-in sessions for Discord, Telegram, Steam and Roblox. [9]
   • Then it reads the victim's email, including food delivery receipts, to learn where they live. [9]
   • It sends the file to AI models for a report on what the victim is worth. [9]
   • Its instructions tell the AI it is "a forensic intelligence analyst". [9]
   • It asks Anthropic's Claude first, then Moonshot's Kimi or Google's Gemini if refused. [9]

   Who is involved

   • Cisco Talos security researchers
   • Young people online
   • Many attackers possible buyers
   • CAIRN Talos tool that spots malware using AI

   How it unfolded

   1. First Claude
   2. If refused Kimi
   3. Then Gemini

   Why it matters

   It seems built for young people with busy online lives, Wired reports. [9]

   How it works

   Security researchers call this triage: deciding which victims to work on first. [9]

   Why a leak of names and emails still matters

   Firms rate names, emails and job titles low-risk because they open no account, but they tell a scammer whom to fool.

   The twist

   The low-risk label only checks whether data can open an account. A scammer cares whether it says whom to fool and how to sound believable.

   The picture

   8 of 14

   retailers that asked for a birth date

   Step by step

   1. 1 A company sorts the data it holds into levels by the harm a leak would do
   2. 2 Passwords, keys and case files are rated high, because they open things
   3. 3 Names, emails, job titles and birthdays open nothing alone, so they are rated low
   4. 4 Low-rated data is collected freely and guarded more lightly
   5. 5 A scammer uses it to pick the right person and make a fake message sound real

   The same force, elsewhere today

   Where this chain is also running, in today's other stories.

   • Shops' birthday questions

     Retailers ask for a birth date because it helps their marketing, and a fake bank caller later reads it out to sound real.

   • The Volta malware

     It treats food delivery receipts and game logins as clues, then asks an AI model to rank each victim by worth.

   Where you've seen this

   Company staff lists

   a public list of who works in accounts tells a fraudster where to send a fake invoice

   Hotel front desks

   a room number opens no door, but said aloud it tells a stranger which door to knock on

   School contact lists

   a parent's name and a child's class let a fake message sound like it came from the school

   The catch

   Guarding every name as hard as a password would stop ordinary work, so firms still need the levels to decide where the strongest locks go.

   And the whole of it

   The people on Chainalysis's list work at police forces and exchanges, and the shoppers in the Guardian story typed a birthday into a form. Anyone who has filled in a sign-up form is on lists like these, and nobody on those lists can see where their details go next.

   The truth

   • Faster sorting matters because stolen login tokens expire and passwords get changed, Fetterman says. [9]
   • Talos did not track whether Volta has been used against real people. [9]
   • Talos thinks Volta may be built to sell to many different attackers. [9]
   • Who gains Less skilled attackers — Malware like Volta hands the sorting of stolen data to AI, which Talos says puts stronger tools in less skilled hands. [9]
   • Nobody knows yet

     Whether Volta has been used against real people.

     Talos did not track whether it has been used outside its own tests. [9]

   Good news

   • Talos caught it with CAIRN, a new tool built to spot malware that uses AI. [9]
   • Cisco Talos caught the Volta malware with CAIRN, a new tool built to spot malware that uses AI.

1. 06

   Russian home goods chain shut for five days

   What happened

   • Poryadok, a Russian chain selling home goods, closed some shops after a cyberattack. [10]
   • Its website and app were down for 5 days running, and some shops shut. [10]
   • Customers could not collect paid orders, use loyalty points or reach support. [10]
   • Local media say shops in Voronezh, where the company began in 2010, stayed shut. [10]
   • Poryadok confirmed a cyberattack but has not said how hackers got in. [10]

   Who is involved

   It runs 48 stores in 32 Russian cities. [10]

   • Poryadok Russian home goods chain
   • Shoppers who had paid

   How it unfolded

   Hackers hit the Russian pizza chain Dodo Pizza in September. [10]

   The travel site Anywayanyday paused bookings after an attack in mid-October. [10]

   1. September Dodo Pizza hit
   2. Mid-October Anywayanyday pauses bookings
   3. Late October Poryadok shuts

   Why it matters

   Shoppers who had already paid were left without their goods or a way to ask. [10]

   The truth

   • Nobody has said who attacked, or whether customer data was taken. [10]
   • Who pays Poryadok's customers — For 5 days they could not collect paid orders, use loyalty points or reach support. [10]
   • Nobody knows yet

     Who attacked Poryadok, and whether customer data was taken.

     The company confirmed a cyberattack and said nothing about who or what. [10]

   What comes next

   Poryadok says its shops will reopen, but it gave no date. [10]

2. 07

   Shops' birthday questions help scammers, experts say

   What happened

   • Security experts told the Guardian that birthdays collected by shops help scammers. [11]
   • Alexandre François found 8 of 14 retailers he checked asked for a birth date. [11]
   • He says shops keep the field because it tells them customers' ages for marketing. [11]
   • A fake bank caller can read out a person's name, address and birthday to sound real. [11]
   • ESET adviser Jake Moore says a birth date alone is "not particularly valuable" to criminals. [11]
   • Joined with names and phone numbers, it helps them pretend to be someone, he says. [11]

   Who is involved

   François investigates scams at WhoisXML API, an intelligence company. [11]

   • Alexandre François scam investigator
   • Fake bank caller
   • Customer
   • Shops gain customers' ages
   • Customers carry the risk of a hack

   How it unfolded

   Asos customers' birth dates were among the details taken in a recent hack. [11]

   Why it matters

   So a birthday typed into a shop form can later make a scam call sound real. [11]

   How it works

   Serpil Hall of Datos Insights says leaks get joined into an "enriched identity profile". [11]

   Retailers ask for a birth date because it helps their marketing, and a fake bank caller later reads it out to sound real.

   The idea, in story 05: Why a leak of names and emails still matters →

   The truth

   • Shops gain a customer's age, which helps them aim adverts. [11]
   • Customers carry the risk when that shop is hacked. [11]
   • François says only banks, tax offices and official checks truly need a real birth date. [11]
   • Who gains Shops that ask for a birth date — The date tells them each customer's age, which helps them aim adverts, François says. [11]