Chainalysis Meltdown: Full Credential Exposure, Services Pulled Offline as AI-Driven Attacks Surge
Chainalysis has had a rough week. The blockchain analysis company has now confirmed that an ongoing cyberattack exposed names, usernames, password hashes, and live session tokens for its entire user base. As a precaution, it pulled Reactor, Data Solutions, the Know Your Transaction interface, address screening products, and even its own login page offline.
The company says it has found no evidence that investigation data was accessed or that attribution data was tampered with, which is reassuring, though the bar for reassurance here is admittedly low.
The situation is evolving awkwardly. Chainalysis sent emails urging users to reset their passwords, then immediately clarified that password resets are currently impossible because the login page is down. What it does want you to do is reset passwords on any other service where you've reused your Chainalysis credentials, which is probably a lot of people.
Accounts that were directly compromised have been locked. Customers wanting back into KYT and Address Screening need to contact Chainalysis support with trusted IP addresses to get allowlisted before they can reset passwords and rotate API keys. Reactor and Data Solutions remain offline with no firm timeline given.
The original incident, disclosed less than a week ago, involved what Chainalysis called an "on-path attack" executed using "offensive agentic techniques." The attack vector has apparently been patched, though that detail does limited PR work when your entire user credential database has just been exposed.
Chainalysis noted the attack resembles incidents hitting "many other tech platforms in recent weeks," which is both true and something of an understatement.
AI as Attack Infrastructure
This is part of a wider and genuinely concerning trend. Several companies including Chainstack, OpenCode, Warp, and WorkOS have recently disclosed attacks involving AI-driven offensive tooling. The name cropping up repeatedly is ARTEX, an autonomous penetration testing framework that threat actors are deploying to scan public GitHub repositories for exposed secrets at scale.
Microsoft has been tracking this activity and published its own analysis. The core capability ARTEX provides is not just faster scanning, it is the ability to automatically analyse results and chain follow-on attacks without requiring the attacker to sit at a keyboard throughout. One documented case saw an AI agent move from finding credentials on GitHub to exfiltrating data from an Azure Key Vault in under five minutes. Microsoft assesses this campaign has been active since August 2026.
The post-exploitation behaviour involves using stolen application credentials to access Microsoft Entra ID tenants, then pivoting into connected Azure and Microsoft 365 resources. Sign-ins traced back to two IP addresses, 199.19.77.84 and 199.19.77.18, with agents successfully authenticating across dozens of applications spanning multiple tenants. Targets included storage account keys, connection strings, AKS credentials, SharePoint, OneDrive, and mailbox contents. The agents showed a particular appetite for credentials giving access to AI services, including API keys for major providers and OAuth applications tied to Azure AI tooling.
The LLMjacking Economy
Google's security subsidiary Wiz published research this week that maps out what happens to all these stolen AI service credentials. A criminal market layer they're calling LLM Mixers has formed to monetise them. These operations buy or steal enterprise LLM account access and resell it on underground markets, letting paying customers run queries against frontier models without needing legitimate API credentials or cloud infrastructure of their own.
The stolen accounts keep accepting requests while the legitimate owners accumulate bills. The mixers proxy traffic across multiple compromised accounts, distribute consumption to avoid detection, and obscure where requests are actually originating. Some victims are reportedly absorbing hundreds of thousands of dollars in unexpected API charges.
Wiz identified at least two active resale operations using stolen AWS Bedrock keys: llm-routing.com (operating under the name momo) and xingjiabiapi.org, both offering access to current frontier models at heavily discounted rates. Neither operator is confirmed to have conducted the original credential theft.
One detail worth flagging: the IP address behind llm-routing.com, 23.106.46.239, was hosting an ARTEX landing page in mid-October 2026. That same address was flagged as a compromise indicator by Zeabur following its own breach last month, in which over 3.2 million environment variable records and data from more than 321,000 accounts were exfiltrated after an attacker found credentials stored in plaintext.
Suspected IP addresses linked to LLM token abuse and resale include 23.106.46.239, 38.246.114.118, 104.243.32.50, and 31.57.201.201.
The emerging picture is of a fairly organised criminal ecosystem where AI tooling handles the attack automation, stolen credentials get laundered through mixer services, and the whole operation scales horizontally across targets. For security teams, the practical upshot is straightforward: audit what secrets you have sitting in repositories, rotate credentials aggressively, and treat AI service API keys with the same sensitivity as production database passwords. Because apparently a lot of organisations have not been doing that.