# Chainalysis says an attacker used AI agents to breach it, a week after a refusal-stripped DeepSeek cyber model went on sale

The crypto-tracing firm says customer names, emails and job roles were exposed but not case files or credentials, and the top openly available model on one cyber benchmark is now sold with its refusals removed.

- Published: 2026-11-01T06:20:01.798Z
- Canonical: https://polylog.news/ai/2026-11-01/chainalysis-says-an-attacker-used-ai-agents-to-breach-it-a-w
- Publisher: Polylog (AI desk)
- Section: tech
- Sources: [Yahoo Tech](https://tech.yahoo.com/cybersecurity/articles/chainalysis-firm-hunts-crypto-hackers-122556835.html), [ShiftDelete](https://en.shiftdelete.net/chainalysis-data-breach/), [Inference on X](https://x.com/inference_net/status/2114813188034433124), [Inference](https://inference.net/models/deepseek-v4.1-flash-1017-cyber/), [Artificial Analysis on X](https://x.com/ArtificialAnlys/status/2113682654709313811), [Anthropic Research](https://www.anthropic.com/research/team/frontier-red-team)

Chainalysis, whose blockchain-tracing tools are used by more than 100 banks as well as exchanges and government agencies, [told customers that an outside attacker used "offensive agentic techniques"](https://tech.yahoo.com/cybersecurity/articles/chainalysis-firm-hunts-crypto-hackers-122556835.html) to access its systems. In a Friday announcement, the company said the attacker took user IDs, full names, email addresses and job role labels. It said case files, passwords, login codes and session tokens show no sign of access. Chainalysis has not said how much of the intrusion the AI performed without human direction. It has hired outside security experts and is [using large language models to search for weaknesses](https://en.shiftdelete.net/chainalysis-data-breach/).

The leaked fields are names, roles and employers at banks and agencies that investigate crypto crime. That set is useful for targeted phishing against investigators, even without case data.

The disclosure came days after the hosting provider Inference made [a refusal-stripped checkpoint of DeepSeek V4.1 Flash available](https://x.com/inference_net/status/2114813188034433124) and described it as the first of several cyber models it will release. The [model page](https://inference.net/models/deepseek-v4.1-flash-1017-cyber/) describes an "abliterated" version of the October 17 checkpoint: a 552-billion-parameter multimodal mixture-of-experts model with tool calling and a one-million-token context, sold on enterprise plans only. Artificial Analysis rated the unmodified base checkpoint [first among openly available models on its Cyber Index](https://x.com/ArtificialAnlys/status/2113682654709313811), with a score of 57%. It noted that some restricted proprietary models may score higher.

That restricted tier is the contrast. Anthropic's [Frontier Red Team](https://www.anthropic.com/research/team/frontier-red-team) has published work saying Claude Mythos Preview crossed a threshold in offensive cyber capability. Anthropic responded with Project Glasswing, which uses the model to harden critical software before comparable capability reaches attackers. Closed labs restrict offensive cyber capability by controlling who is allowed to use it. Open weights, combined with refusal removal, take that control away for anyone who can download or rent the model.

## What this means

Closed labs control offensive cyber capability by deciding who may use their models. A downloadable checkpoint with its refusals removed eliminates that control for anyone who can obtain the weights. Defenders and attackers now have access to the same open capability, and the closed tier keeps an advantage only at the highest capability level. Security vendors gain more customer spending, and firms whose products are themselves repositories of data about other institutions lose, including Chainalysis, identity providers and threat-intelligence platforms. Many assume that safety restrictions at frontier labs slow attackers down. The Chainalysis case suggests that agent-assisted intrusions already succeed against ordinary enterprise targets using whatever models attackers can obtain. The more likely outcome within months is a series of breach disclosures that cite agentic techniques, followed by insurers and regulators asking firms to show they use AI-assisted monitoring of their own systems. That outcome depends on attribution language like Chainalysis's becoming standard. If a forensic follow-up shows the Chainalysis intrusion was mostly manual, this reading would weaken.

## What to watch

- A technical post-mortem from Chainalysis on what the agents did. It would show whether "agentic" described end-to-end automation or tooling that helped a human operator.
- Whether Inference releases the further cyber models it promised and whether US authorities act on hosted access to refusal-stripped Chinese checkpoints. That would test whether open-weight cyber capability can be restricted at all.
- Phishing campaigns aimed at bank and agency staff named in Chainalysis's user records. These would be the first observable use of the stolen data.