Agentic AI Attacks Compromise Chainalysis, Spark Cloud Credential Resale Wave

Chainalysis, a blockchain analysis platform, disclosed a breach resulting from an agentic cyber attack that exposed user credentials including names, usernames, password hashes, and live tokens for all users. The company immediately took multiple services offline including Reactor, Data Solutions, the KYT interface, address screening products, and the login page. Although Chainalysis reports finding no evidence that investigative data was accessed, it has locked all affected accounts and is requiring password resets and API key rotation before service restoration.

The Chainalysis incident is one of several attacks targeting technology companies through autonomous AI systems, particularly a tool called ARTEX. Chainstack, OpenCode, Warp, and WorkOS have all reported similar attacks. Microsoft’s analysis found that threat actors deploy these autonomous agents to scan GitHub repositories for exposed secrets, then use the stolen credentials to compromise cloud environments. One documented attack cycle escalated from GitHub credential discovery to Azure Key Vault exfiltration in five minutes. Attackers have focused consistently on AI service credentials and OAuth tokens to establish persistence across Azure, Microsoft 365, and connected cloud infrastructure.

A secondary market has emerged where stolen cloud credentials are resold to paying customers. Operators running sites like llm-routing.com and xingjiabiapi.org sell compromised AWS Bedrock keys and other LLM platform access at discounted rates, creating an intermediary system that obscures the theft’s origin while reducing friction for attackers seeking cloud access. This monetization model creates strong financial incentive to steal developer platform credentials, with threat actors potentially accruing hundreds of thousands in unauthorized LLM API charges against victim accounts. Infrastructure analysis reveals potential overlap between the LLMjacking operations and the agentic attack ecosystem.