By Javier Surasky
.png)
The theft of more than USD 6 billion in crypto assets from Binance on October 29, 2026, brought a rarely discussed dimension of digital power into focus: the ability to interpret the trails money leaves as it moves.
On October
31, the U.S. Federal Bureau of Investigation (FBI) attributed the theft to
North Korea, linking it to the malicious cyber activity it calls TraderTraitor.
Its statement, however, does not disclose all the evidence supporting that
attribution (Federal Bureau of Investigation, 2026).
Among the
actors involved in tracing the funds was Chainalysis, a company specializing in
blockchain transaction analysis. According to its report on the attack, it
shared investigative leads with other participants to help identify and freeze
stolen assets (Chainalysis, 2026c). We include it in our AI Power Map because
of this intermediary role: Chainalysis turns transaction records into
intelligence that can guide investigations and financial oversight decisions.
The use of
artificial intelligence (AI) expands the tools available for this work and
raises a familiar tension within the AI ecosystem: public authorities that, to
strengthen their ability to act, must become more dependent on knowledge organized by a private company.
Public
data, private capabilities
To
understand Chainalysis’ business, we need to distinguish between observing a
transaction and understanding who is involved in it. On public blockchains such
as Bitcoin, movements between addresses are visible, but those records do not
necessarily identify the people or entities behind them.
Attributing
a transaction means precisely that: linking addresses to entities or services
through additional evidence and analytical procedures. Blockchain intelligence
companies sell this capability by combining address clustering, labels, and
tracing tools (Lubbertsen et al., 2025). The fact that some of the data is
public therefore does not mean everyone has the resources needed to interpret
it.
I argue
that there is a “power to interpret” within the AI ecosystem: the ability to organize information so that certain relationships become visible and can
inform decisions. That power has commercial value.
Where
artificial intelligence comes in
The
company’s relationship with AI needs to be examined more closely. In August
2026, Chainalysis explained that it uses machine learning to generate leads,
detect anomalies, and recognize patterns. It also uses AI technology obtained
through its acquisition of Alterya, a company specializing in AI-based fraud
prevention (Levin, 2025). More recently, it introduced a range of agents,
including “Chain,” which allows users to ask questions in natural language and
offers tools for generating investigation graphs, reports, and workflows. The
company itself noted that the offering was still in beta as of November 1, 2026
(Chainalysis, n.d.-a).
However,
Chainalysis states that it does not use predictive models to construct
structural wallet segments, a task for which it requires deterministic,
reproducible, and auditable procedures (Chainalysis, 2026b).
This
distinction matters in the Binance case: the Chainalysis report describes signs
of automation in the movement of stolen assets, but it does not establish that
AI was used to carry out the attack, nor does it attribute all its tracing
results to AI (Chainalysis, 2026c).
From
private leads to public action
Chainalysis’
cooperation with public authorities has been acknowledged outside the company.
In June 2026, the U.S. Department of Justice announced the seizure of
infrastructure used by subsidiaries of the Huione Group and expressly thanked
the intelligence teams at Chainalysis and Elliptic, together with Google’s
CyberCrime Investigation Team, for contributing information to the
investigation (U.S. Department of Justice, 2026). The example shows how these
relationships work: a company supplies information, public agencies incorporate it into an investigation, and those agencies act under their legal powers. A
company therefore does not need the authority to order an asset freeze for its
classifications to influence the decisions of those who do.
This
relationship must be understood in a context where technical capabilities and
human expertise are unevenly distributed. It raises the question of how well
equipped a public authority actually is to review the assumptions and
reconstruct the reasoning that ultimately guide its actions.
There is
also the question of how effectively these systems detect the activity they are
designed to identify. A study presented by Lubbertsen, van Eeten, and van
Wegberg (2025) assessed whether Chainalysis correctly linked cryptocurrency
addresses to three platforms used for criminal activity: BestMixer, Hansa
Market, and Wall Street Market. The researchers compared the tool’s results
with data from those platforms obtained by the authorities. They found very few
incorrect links, but the proportion of activity Chainalysis could identify
varied by platform and period. The findings were favorable, although they do
not establish that the tool performs equally well in other cases.
That
finding supports the usefulness and reliability of Chainalysis’ attribution
work, but it does not mean all relevant relationships are being examined. In
other words, a tool can produce reliable results within its coverage while
leaving out a substantial share of the activity investigators are trying to reconstruct. Knowing what is being left out matters, even if that knowledge can
only ever be partial: how can we describe what we failed to find?
Anyone
making decisions in the public interest or on behalf of a business still needs
to know how a result was produced and what its scope and limitations are.
Chainalysis itself distinguishes between the probabilistic signals that guide
an investigation and the claims it supports through auditable methods
(Chainalysis, 2026b). This second distinction should remain visible when
information moves from the platform into a case file or, a step further,
informs a financial compliance decision.
The
argument so far makes clear that access to a tool such as Chainalysis must,
given the potential consequences of its findings, be accompanied by the ability
to challenge them. My proposal is that institutions using information supplied
by Chainalysis and similar companies ensure they have staff capable of
reviewing the analysis, and that their contracts provide sufficient access to
the methodological documentation needed to understand the company’s procedures.
Whenever a classification contributes to a measure affecting an individual, a
group of people, or another company, there should also be an effective way to
request a review.
The
intermediary’s security
The
concentration of specialized knowledge also creates a security concern. On
October 30, 2026, Chainalysis reported a separate incident unrelated to the
Binance theft. According to its statement, an external actor used offensive
techniques involving AI agents to gain unauthorized access to internal systems
and tools, obtaining names, email addresses, and other information about users
of its platform. The company said, however, that it had found no indication of
unauthorized access to investigation content or query results (Chainalysis,
2026a).
The full
extent of that incident remains under investigation. It is a reminder that the
security of those supporting an investigation is part of the security of the
investigation itself.
A power
that must be open to scrutiny
Chainalysis
expands our map to include actors capable of making sense of activities that
others cannot understand. They bring together data, methods, experience, and
human expertise to turn digital money trails into intelligence that can be
acted on. AI expands that capability and makes it easier to incorporate into
the everyday work of businesses and governments.
But when
that service becomes difficult to replace, a sensitive political issue emerges:
better investigative tools can give a state greater autonomy in confronting
criminal networks, while reliance on interpretations it cannot review can
reduce its autonomy in relation to the provider.
The
challenge is to organize this work so that the knowledge acquired can be
verified by the state and challenged by those affected by it. When a private
interpretation contributes to a public decision, the institution making that
decision must be able to explain its reasons and establish mechanisms through
which those who believe they have suffered harm can seek redress.
The
Chainalysis case shows that digital power is also built by organizing what
others can know. In this context, choosing a provider takes on a political dimension that receives little attention.
Basic
data:
Chainalysis
was founded in 2014 by Michael Gronager, Jan Møller, and Jonathan Levin. Levin
is its current CEO.
The company
provides data, software, and services to government agencies, cryptocurrency
exchanges, and financial institutions.
According
to its company website, as of November 1, 2026, its solutions were used by more
than 1,500 organizations in over seventy countries (Chainalysis, n.d.-b).
In January
2025, Chainalysis acquired Alterya, a company specializing in AI-based
financial fraud prevention, with a focus on cases in which victims authorize
payments because they have been deceived. Its technology seeks to identify
accounts and addresses linked to scams so that banks and payment platforms can
intervene before victims transfer their money (Levin, 2025).
Chainalysis’
value was estimated at USD 1.62 billion in late October 2026 (DefiLlama, n.d.),
considerably below the USD 8.6 billion valuation announced in its May 2022
funding round, although the two figures reflect different methods and contexts.
References
Chainalysis.
(2026a, October 30). Chainalysis security incident information. https://www.chainalysis.com/blog/security-incident-october-30/.
Chainalysis.
(2026b, August 14). Machine learning has a specific role in blockchain
intelligence. https://www.chainalysis.com/blog/ml-role-in-blockchain-intelligence/.
Chainalysis.
(2026c, October 30). The $6.4 billion Binance hack: Tracing the North Korea
link. https://www.chainalysis.com/blog/binance-exploit-latest-findings-and-response/.
Chainalysis. (n.d.-a). Chainalysis agents: AI for
blockchain intelligence. Retrieved November 1, 2026. https://www.chainalysis.com/ai-agents/.
Chainalysis. (n.d.-b). Company.
Retrieved November 1, 2026. https://www.chainalysis.com/company/.
DefiLlama.
(n.d.). Chainalysis. Retrieved November 1, 2026, from https://defillama.com/pre-ipo/chainalysis
Federal
Bureau of Investigation. (2026, October 31). North Korea responsible for $6
billion+ Binance attack. https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack.
Levin, J.
(2025, January 13). Welcoming fraud detection innovator Alterya to
Chainalysis and doubling down on the prevention of illicit activity. Chainalysis.
https://www.chainalysis.com/blog/chainalysis-alterya-announcement/.
Lubbertsen, K., van Eeten, M., & van Wegberg, R. (2025).
Ghost clusters: Evaluating
attribution of illicit services through cryptocurrency tracing. In 34th
USENIX Security Symposium (USENIX Security 25) (pp. 1357–1374). USENIX
Association. https://www.usenix.org/system/files/usenixsecurity25-lubbertsen.pdf
U.S. Department of Justice. (2026, June 23). Justice Department seizes backend infrastructure used by the Huione Group for money laundering services. https://www.justice.gov/opa/pr/justice-department-seizes-backend-infrastructure-used-huione-group-money-laundering-services?trk=article-ssr-frontend-pulse_little-text-block.