by Brooke Watson | Dynamis LLP
On October 30, Chainalysis disclosed that an external actor had used what it called “offensive agentic techniques” to gain unauthorized access to its systems and internal tools. The next day, the FBI attributed more than $6 billion stolen from Binance to North Korea. Elliptic puts that theft at $6.43 billion, the largest cryptocurrency theft on record.
The Chainalysis disclosure has since become more serious: on November 4, the company confirmed that a subset of customer passwords had been exposed and subsequently took additional screening products offline. Chainalysis says its incident is unrelated to the Binance theft, and its notice does not publicly identify the attacker or specify how much of the intrusion was autonomous.
In my earlier post on what happens when your wallet touches stolen Binance funds, I focused on the people caught downstream of a theft. This time, the questions concern the intrusion itself and the integrity of the systems investigators use to follow the money.
Below is how I would expect DOJ to approach a breach like this, what evidence I would look for first, and what the existing law means for people who build or run offensive agents. This is an assessment of possible investigative steps, not a report of what prosecutors are actually doing in this case.
What we know about the Chainalysis breach
The facts below come from Chainalysis’s October 30 notice and its November 2 and November 4 updates, including the 10:30 a.m. EST update on November 4. The company describes an ongoing investigation, so these are dated statements, not final findings.
The intrusion: Chainalysis describes “an external actor using offensive agentic techniques” to access its systems and internal tools without authorization; its notice does not identify the model, toolkit, or degree of autonomy.
Customer information: The company initially disclosed access to user IDs, full names, email addresses, and organization role labels, which it characterized as “non-sensitive,” and said affected organizations would receive a detailed breakdown once its analysis was complete.
Passwords: On November 4, Chainalysis confirmed that an “on-path attack” exposed a subset of customer passwords and said that attack vector had been contained and remediated. That update supersedes the earlier reassurance about authentication credentials; affected customers were being notified and their accounts locked as a precaution.
Investigation content: In its October 30 notice, Chainalysis said it had found no evidence of unauthorized access to investigation content, including graphs, notes, or cases, based on the evidence then available. The November 4 updates do not announce a finding that those materials were accessed, but they do describe continuing threats and an ongoing investigation.
Product availability: On November 2, Chainalysis said it had taken Reactor and Data Solutions offline while continuing to operate compliance transaction monitoring products. By 10:30 a.m. EST on November 4, it had also taken KYT’s interface and API, other address-screening products, and its login page offline; Reactor, Data Solutions, and Chain (Beta) remained offline.
The notice does not provide a total number of affected users or establish whose government or law-enforcement accounts, if any, were exposed. Readers should check the live notice for later changes, particularly before following password-reset or service-restoration instructions.
How I would expect DOJ to approach the case
I would expect two parallel concerns: investigating the intrusion and assessing any effect on government users or evidence.
Who is on the list: Chainalysis’s customers include law-enforcement and government agencies, according to Help Net Security. I would want to know whether the accessed records identify investigators, prosecutors, or analysts, and whether their roles could make them targets for follow-on phishing or intelligence collection.
Who ran the operation: Attribution would affect the investigative approach, but it is not a simple choice between a criminal team and a national-security team. DOJ’s CFAA charging policy and national-security coordination rules contemplate coordination among U.S. Attorney’s Offices, the Computer Crime and Intellectual Property Section, and national-security components as appropriate, including where state involvement is suspected rather than proved.
Where the records are: I would want relevant logs preserved quickly, then seek records from any model, cloud, or hosting provider the evidence identifies. The public notice names no such provider, and the legal process would depend on the service and records involved; where the Stored Communications Act applies, communications content and basic subscriber records receive different treatment.
What the human instructed: Prompts, configuration files, scope limits, payment records, and activity logs are where I would look to reconstruct the operator’s role. I would not treat a model-generated plan as interchangeable with a human instruction, or assume that a retained prompt proves who wrote it.
What happened to case evidence: Prosecutors using Reactor-derived evidence should assess whether the incident raises case-specific reliability, expert-disclosure, or favorable-evidence issues under the applicable discovery rules. An outage alone does not answer those questions.
Preservation would come before any assumption that the entire prompt history can be recovered: § 2703(f) provides a preservation mechanism for covered providers, and DOJ’s CFAA policy recognizes the urgency created by short electronic-evidence retention periods. My first question would be what records exist, not what a hypothetical provider ought to have kept.
Chainalysis Reactor on trial: the Sterlingov ruling
Five weeks before the breach disclosure, the D.C. Circuit affirmed the Bitcoin Fog convictions in United States v. Roman Sterlingov, No. 24-3161, and upheld admission of the challenged Reactor-based expert testimony. The September 25 opinion discusses both the software’s reliability and the defense’s unsuccessful effort to obtain its source code.
The experts acknowledged that Reactor had not been peer-reviewed and that they did not know its error rate, but the court treated those considerations as non-dispositive. It also relied on law-enforcement and industry use, anecdotal accuracy, corroborating information, and explanations of the tool’s methods and assumptions.
On source code, the trial court repeatedly asked Sterlingov to explain why access was “material and relevant,” and the appellate court said he never supplied that explanation. Sterlingov's counsel and qualified experts received access to Reactor's heuristics and underlying assumptions under a protective order, although Sterlingov himself was prohibited from reviewing the material. The appellate court also held that Sterlingov had forfeited his challenge to denial of the Rule 17(c) subpoena by not raising it in his opening brief.
The breach could prompt new questions, but the company’s public disclosure does not establish that Reactor’s code, tracing data, or historical outputs were altered. A stronger discovery request would connect the incident to the particular systems, software version, data, or outputs used in the defendant’s case, rather than assume that a vendor breach automatically satisfies the materiality concerns discussed in Sterlingov or the requirements for discovery under Rule 16.
I would start with narrower questions: when did the compromise begin, which components were affected, what evidence of modification exists, and were the original case outputs preserved? Those answers would matter more to my assessment than the fact of an outage by itself.
The hard CFAA question is the operator’s intent
The Computer Fraud and Abuse Act does not require a defendant personally to type each request: it expressly covers causing certain transmissions, and § 2(b) separately addresses willfully causing acts through an intermediary. Using an agent does not remove the government’s obligation to prove the elements of the particular offense, including the human defendant’s required mental state.
Section 1030(a)(2) reaches intentional unauthorized access, or access exceeding authorization, that obtains information in a covered category. DOJ’s charging policy requires prosecutors to be prepared to prove awareness of the facts that made the access unauthorized, not merely subsequent misuse of information the person was entitled to obtain.
That is why the instructions matter, but the victim’s name is not the whole inquiry. An operator who tells an agent to find and exploit unauthorized systems does not necessarily avoid liability because the software selected the eventual target; the inquiry under the CFAA and DOJ’s policy concerns the intended conduct and knowledge of the authorization facts, making a genuinely bounded research instruction followed by an unexpected excursion a different factual question.
Van Buren v. United States, 593 U.S. 374 (2021), describes a “gates-up-or-down” inquiry and distinguishes access to off-limits information from improper use of information a person may obtain. It does not decide AI-agent liability, and the Court expressly left open whether authorization boundaries depend only on technological restrictions or also on contracts and policies.
The damage provisions also require precision: § 1030(a)(5)(A) covers knowing transmission that results in intentional damage without authorization, while subsections (B) and (C) address intentional unauthorized access followed by reckless damage, or damage and loss. The statutory definition of “damage” concerns impairment to integrity or availability, so access to information alone does not establish every damage-based charge.
Who is liable when an AI agent hacks?
One provision prosecutors could consider is 18 U.S.C. § 2(b), which makes a person punishable as a principal when that person willfully causes an act to be done that would constitute a federal offense if performed directly by that person or another. It can reach conduct carried out through an intermediary or instrumentality, but the government must still establish the mental state required for the underlying offense.
That is a general liability principle, not a claim that a court has already resolved every autonomous-agent scenario. For me, the evidence would come down to three questions.
What did the instructions say? I would compare the original prompt, system instructions, configuration, and technical scope controls with what the agent actually did. I would also look for later changes that widened or narrowed the task.
What did the operator know? I would examine alerts, log reviews, approvals, and the response to signs that the agent had reached an unauthorized system. I would distinguish what the person actually saw from what a monitor could have shown them.
What did the person cause? I would trace the connection between the operator’s conduct and the charged access or damage. I would not assume that launching software, standing alone, answers every causation and intent question.
Other charges would require their own proof: wire fraud needs a qualifying fraudulent scheme and an interstate or foreign wire transmission in its execution, not just a hack. Aggravated identity theft under § 1028A(a)(1) requires knowing transfer, possession, or use of another person’s means of identification without lawful authority during and in relation to an enumerated predicate felony, and generally adds two consecutive years. Under Dubin v. United States, 599 U.S. 110 (2023), a charged “use” must be at the crux of what makes the predicate conduct criminal, rather than incidental to it; exposed names alone do not establish that offense.
Tool developers are not categorically outside the inquiry: in 2019, Marcus Hutchins pleaded guilty to conspiracy to commit computer fraud and advertising an interception device in a scheme involving development and for-profit distribution of banking malware. That case is not a rule that publishing offensive research software is itself criminal; I would look at the developer’s conduct, customers, representations, assistance, and intent, not the label “research framework.”
The hard cases: red teams, bug bounties, and agents left running
The straightforward hypothetical is an operator deliberately directing unauthorized intrusion. The cases I would watch most closely are the ones where scope, knowledge, and actual conduct separate.
The red team that wandered: A firm is hired to test Company A, and its agent reaches a vendor’s system. The question is not simply whether the vendor signed the firm’s contract; under DOJ’s CFAA policy, the inquiry concerns actual authorization and the operator’s knowledge of the facts making access unauthorized.
The bug bounty that went too far: DOJ’s May 2022 policy announcement says qualifying good-faith security research should not be charged under the CFAA, but the current policy creates no enforceable rights and is not a statutory defense. Whether research qualifies requires a separate assessment under the policy’s good-faith criteria; going beyond a bounty’s terms does not by itself answer every authorization or good-faith question.
The agent left running: In Global-Tech Appliances, Inc. v. SEB S.A., 563 U.S. 754 (2011), a civil patent case drawing on criminal-law principles, the Supreme Court described willful blindness as subjective belief in a high probability of a fact plus deliberate action to avoid learning it. That is more than negligence or recklessness, so leaving an agent unattended is not automatically willful blindness, much less automatic proof of intent to damage a system.
The tool on GitHub: I would not equate a public research release with knowingly helping a customer attack a victim. I would examine the build history, documentation, distribution, communications, and support actually provided before drawing conclusions about the publisher.
These concerns are not limited to hypothetical evaluations: OpenAI’s account describes agents operating with reduced safeguards that compromised infrastructure and accessed Hugging Face, while Anthropic reported unauthorized access to three organizations during third-party cybersecurity evaluations. The accounts describe different failures, including exploitation of isolation weaknesses in OpenAI’s case and misconfigured internet access in Anthropic’s.
Those incidents should not be treated as legally identical to an attacker targeting Chainalysis. Instructions, authorization, safeguards, knowledge, and response are the facts I would want before assessing criminal exposure.
If you build or run offensive agents
My practical recommendation is to build the record before you need it, and to make the controls match the stated task. Treat the following as precautions, not promises of immunity.
Write the scope down: Obtain authorization covering the systems you intend to test, and specify targets, methods, exclusions, and stop conditions. Put those same limits into the agent’s operating instructions and technical controls.
Preserve the record: Keep prompts, configurations, approvals, alerts, and action logs under an appropriate retention and security plan. Distinguish operator instructions from model-generated plans and preserve the original records.
Monitor it or constrain it: Use allowlists, network boundaries, approval gates, and monitoring appropriate to the task. Do not rely on a sentence in a prompt as your entire containment plan.
Stop and escalate when it strays: Establish a process for suspending activity, preserving evidence, and involving the right security and legal personnel. Make the escalation path clear before a test begins.
Get advice before a substantive interview: If investigators or a victim’s counsel contact you, consult counsel before giving a detailed account. Do not send confidential facts through an unsolicited message or website form, including this one.
The question I would expect to drive a prosecution is not whether the software could act on its own. Under the CFAA, § 2(b), and DOJ’s charging policy, the inquiry concerns what the person authorized, intended, knew, and caused, measured against the offense actually charged.
Chainalysis hack FAQ
Was Chainalysis hacked? Chainalysis disclosed unauthorized access on October 30, saying an external actor used “offensive agentic techniques.” Its public notice does not identify the actor or specify the degree of automation.
What data was exposed? The initial disclosure and November 4 update identify access to user IDs, full names, email addresses, and organization role labels, followed by confirmation that a subset of customer passwords had been exposed. The company’s October 30 statement said it had found no evidence of unauthorized access to investigation content, based on the evidence then available.
Is Reactor down? As of the November 4, 10:30 a.m. EST update, Reactor, Data Solutions, and Chain (Beta) remained offline, and KYT, other address-screening products, and the login page had also been taken offline. Check the company’s live notice for later changes.
Was this connected to the Binance theft? Chainalysis says the incident is unrelated to the Binance theft. That is the company’s stated assessment, not a finding made in court.
Can someone be charged if an AI agent carried out the intrusion? Potentially yes: existing computer-crime law and § 2(b) can reach a person who commits an offense through a tool or willfully causes the prohibited conduct. The government must still prove the human defendant’s required mental state and the other elements of the underlying offense, as well as causation; using an agent is neither automatic immunity nor automatic guilt.
Brooke Watson is a partner in the Miami office of Dynamis LLP. She spent a decade as a federal prosecutor in the U.S. Attorney's Office for the Southern District of Florida, most recently as the district's Deputy Criminal Chief. She served as the office's Digital Asset Coordinator and its Computer Hacking and Intellectual Property (CHIP) Coordinator, and she prosecuted cyber cases in its National Security Section
Today Brooke represents individuals and companies in cryptocurrency investigations and litigation, white-collar and cyber criminal matters, and sanctions enforcement. She knows how the government builds these cases because she built them.
If you have questions about any of this, contact Brooke or any of our experienced attorneys for a confidential consultation.
Attorney Advertising. This article is for information only and is not legal advice. Reading it does not create an attorney-client relationship. Prior results do not guarantee a similar outcome.