Chainalysis says an attacker used offensive agentic techniques to access internal tools and view user IDs, names, email addresses, organization information and role labels. So far, it reports no evidence of access to investigation graphs, case notes, transaction or query results, cleartext passwords, MFA secrets or session tokens. It is still determining organization-specific exposure while working with outside investigators and applying fixes. Users should be alert to unexpected password-reset or authentication prompts. The company has not disclosed the exact attack model or level of autonomy, and the incident should not be conflated with a separate exchange-fund theft.