NEW YORK: Chainalysis, the New York firm whose published rankings tell cryptocurrency exchanges how exposed they are to breach, has disclosed that attackers obtained login credentials and authentication tokens for all of its customers simultaneously. The company describes a "multifront cyberattack" involving automated AI agents and an on-path interception of data in transit. The clientele being graded now holds a complete inventory of the grader's doors.
An on-path attack does not break down the door; it sits along the corridor and reads the mail. The AI agents reportedly handled scale, meaning the theft was conducted at industrial efficiency by machinery, while the humans supplied the trust. A firm whose commercial product is the assessment of other institutions' vulnerability was assessed by instruments it did not name, in a campaign it did not detect until completion. It is as if a fire inspector returned from lunch to find the hydrants auctioned.
"Our platform aggregates risk signals from hundreds of venues," said a Vice President for Institutional Trust, in a statement provided to this desk. "This quarter, we became a signal."
Declared: an annual methodology scoring the breach exposure of every major exchange, released under the firm's seal. Observed: the theft of access credentials for every client of the assessor, admitted afterward. Measured precisely, the disclosure followed the compromise by a full reporting cycle, and the grading of the industry's exposure concluded within the same fiscal period as the loss of the grader's own keys. This desk records such intervals professionally; on one occasion our dispatches reached the bureau before the incidents they described, filed as a timing credit in our favor.
"We tell clients to operate as though their credentials are already compromised," noted the firm's head of customer assurance. "For once, onboarding is going beautifully."
The exchanges themselves, holders of other primates' deposits, were instructed to rotate everything. The dominant local primate stores its wealth in institutions licensed to store numbers, and audits those institutions through a third institution whose numbers have departed. Nobody has left the system. Enrollment is up.
Exposure grade assigned to all customers: issued. Exposure grade retained by issuer: pending.
