Chainalysis Discloses Customer Data Breach as 12 DeFi Sites Serve Wallet Drainer

Published November 1, 2026, 02:50 AM PKT. Based on Chainalysis's disclosure of October 30, 2026 (primary source), and reporting by TokenPost, CoinScreamer, CryptoAdventure and The Crypto Basic on October 31, 2026 (secondary sources). No source has linked the Chainalysis incident to the DeFi website attacks, and Chainalysis said its incident is unrelated to the Binance theft. Loss figures for the drainer campaign are partial tallies, not campaign totals.

Two separate security incidents hit crypto infrastructure on October 30 and 31, 2026, and both were still being cleaned up as November began. Blockchain intelligence firm Chainalysis disclosed that an attacker got into its systems and internal tools and reached customer profile data, while security firm Blockaid flagged 12 DeFi project websites serving a wallet-draining toolkit after their domains were hijacked. The registrar behind all 12 domains later restored them, and several affected projects reported their sites back online, but the attacker behind the website hijacks, the full loss total, and the number of Chainalysis customers affected all remain undisclosed.

Chainalysis: agentic attack reached customer profile data

Chainalysis said on October 30, 2026 that an external actor used what it called offensive agentic techniques to gain unauthorized access to its systems and internal tools, according to The Block as reported by CoinScreamer and CryptoAdventure. The attacker reached user IDs, full names, email addresses and organization role labels tied to customer accounts. The company said its investigation so far found no evidence of access to investigation graphs, notes or cases, transaction or query results, clear-text passwords, multi-factor authentication secrets or session tokens. It said it is still determining which customer records were accessed, has engaged outside security experts, has notified customers, and advised vigilance toward unexpected authentication prompts and enabling two-factor authentication.

The wording matters because of what Chainalysis does. The firm traces stolen crypto, maps illicit transactions and supplies blockchain intelligence to financial institutions and law enforcement, including work on the October 29 Binance theft, in which about $6.3 billion was stolen. Chainalysis explicitly said its incident is unrelated to the Binance theft. The company has not said which AI models or tools the attacker used, how many accounts were affected, or who the attacker was, and it has promised further updates. The exposed data, names tied to email addresses and organization roles, is the kind of material that supports convincing phishing attempts even though no evidence points to private wallet keys being taken in this incident.

12 DeFi front ends served Step Drainer after DNS hijacks

Blockaid flagged the website attacks overnight on October 31, 2026. Its initial warning identified possible front-end attacks against Flap and Kintsu, and a follow-up named 10 more sites serving Step Drainer, software designed to trick visitors into approving transfers out of their wallets, according to CoinScreamer. The full list in Blockaid's alerts covered Flap, Kintsu, StonkFun, Pickle Finance, Echelon, Origami Finance, FluxBeam, Stakepoint, SupSwap, Longbow, SHPRD and ApeX DeFi. Flap said its domain had been hijacked and was redirecting visitors to an unauthorized website, and Kintsu reported a registrar-level DNS hijack, meaning control of the domain's addressing was seized upstream rather than the project's own servers being broken into.

A DNS hijack turns a familiar address into a trap. Visitors who trust the domain land on an attacker-controlled imitation and are pushed to approve token spending or sign harmful transactions. Kintsu's original warning applied to users who connected or signed from approximately 00:00 UTC on October 31, and it advised revoking approvals and moving funds, according to CoinScreamer. The same advice applies in general to anyone who interacted with a flagged site during the incident window: stop using a suspicious front end, check token permissions on the relevant networks with a revocation tool, revoke suspicious approvals, and move assets to a fresh wallet if harmful transactions were signed. Disconnecting a website alone does not cancel approvals already granted, and revocation cannot recover assets already stolen. Several affected teams said their onchain contracts were not affected, which is an important boundary: a compromised website does not by itself prove a project's blockchain contracts were exploited.

10 domains suspended, about $138,000 traced on EVM chains

All 12 domains were registered through Name.com, according to registry records cited by The Block, and 10 were suspended at the registrar level at 8:32am ET on Saturday, October 31, 2026. The Block traced about $138,000 in stolen funds to three wallets on Ethereum-compatible chains, a partial tally that excludes possible losses on Solana and Aptos, according to The Crypto Basic. That figure should not be read as the campaign total. CoinScreamer stressed that the disclosures do not establish a campaign-wide loss total, a confirmed attacker, or a connection to the separate Chainalysis incident. The alert count and the registrar's later domain count also differ in scope, which is why the two numbers in this story, 12 flagged sites and 15 restored domains, are not a contradiction: Blockaid counted flagged project front ends, while Name.com counted customer domains it restored.

Name.com restores 15 domains as projects report recovery

Name.com said all affected domains had been restored and that it had taken steps to secure the accounts involved, while it continues to investigate the redirects, according to TokenPost on October 31, 2026. Vercel, the hosting platform behind 10 of the affected domains, said Name.com had restored them and that it was helping investigate. Flap said its original website and an alternative domain were back online, though its preceding update said the root cause remained under investigation. Kintsu said its real website had been restored while work with the registrar to establish the cause continued, and warned that DNS caches could temporarily keep directing some visitors to the malicious version. StonkFun reported restoration after taking its website offline and moving infrastructure, said onchain operations were functioning normally, and said it was not aware of affected users, a statement about StonkFun only, not a verified zero-loss result for the whole campaign.

Two incidents, no established link, and what is still unknown

The two stories arrived in the same week as the record Binance theft, and they share a theme, attackers going after infrastructure and access rather than breaking blockchains, but they are not one story. Chainalysis said its breach is unrelated to the Binance theft, and no reporting links it to the Step Drainer campaign either. What remains unknown is substantial: the identity of the website hijackers and the Chainalysis intruder, the full drainer loss across all chains, the number of Chainalysis customer records accessed, which AI or agentic tools were used in the Chainalysis intrusion, and the root cause of the registrar-level hijacks. The next substantive evidence will come from Chainalysis's follow-up disclosure, the registrar's investigation findings, and loss reports from the affected projects. Until then, the confirmed facts are the October 30 Chainalysis disclosure, the 12 flagged front ends, the 10 registrar suspensions, the partial $138,000 traced tally, and the restoration of the redirected domains.

This article is news reporting and is not investment advice.

Sources

• Chainalysis disclosure, October 30, 2026 (primary source for the offensive agentic techniques, the customer profile data accessed, the absence of evidence of access to investigation content, passwords, multi-factor authentication secrets or session tokens, the unrelated-to-Binance statement, and the pending determination of affected records, as reported by The Block via CoinScreamer and CryptoAdventure)
• TokenPost, Name.com Restores 15 Domains After DeFi Website Redirects (October 31, 2026, secondary source for the Name.com restoration, the Vercel statement, and the Blockaid warning sequence)
• CoinScreamer, Blockaid Flags 12 Crypto Sites in Step Drainer Attack (October 31, 2026, secondary source for the 12-domain Blockaid list, the Flap, Kintsu and StonkFun restoration reports, the Kintsu exposure window and revocation advice, and the Chainalysis disclosure details)
• CryptoAdventure, Chainalysis Breach Exposes Customer Data, AI Tools Cited (October 31, 2026, secondary source for the October 30 disclosure date, the data categories accessed, and the unresolved attacker identity and account count)
• The Crypto Basic, TCB Daily Edition: What Happened in Crypto on October 31, 2026 (October 31, 2026, secondary source for the 8:32am ET registrar suspensions, the approximately $138,000 partial tally on Ethereum-compatible chains, and the exclusion of Solana and Aptos losses from that tally)