VULNpocalypse
MediumBreach / campaignMonitoring

Chainstack discloses breach of production systems exposing customer data

Chainstack says an attacker accessed part of its production systems and customer data; rotate node credentials, API keys and passwords.

Published
Exploitation
Yes, according to Chainstack as reported by The Hacker News, an external attacker gained unauthorized access through a third-party component

What happened

Blockchain infrastructure provider Chainstack disclosed that it was targeted in a cyber attack that gave an unauthorized party access to some parts of its infrastructure, according to The Hacker News. Chainstack said an external attacker got in “through a third-party component.” The company has not named the component, so it is not confirmed.

The Hacker News reports Chainstack’s timeline:

  • October 26, 2026: the attacker accessed a development environment.
  • After that: the attacker escalated access to reach “some parts of our production environment,” Chainstack said.
  • October 31, 2026: Chainstack detected the intrusion and cut off the attacker’s access the same day.

According to the report, the attacker accessed a database containing customer account information:

  • organization names
  • account holder names
  • email addresses of organization members on Chainstack
  • password hashes

Chainstack also said the attacker “had access to systems holding node credentials.” It added: “We have no evidence they were read, but we are treating them as exposed” (The Hacker News).

The Hacker News assesses that the incident overlaps with a campaign by a China-linked cluster using the AI agent framework ARTEX. Chainstack itself did not disclose specifics about the attacker, so attribution is not confirmed by the company.

Details that are not confirmed in the source:

  • how many customers are affected
  • the hashing algorithm used for the passwords
  • whether any data has been misused

Am I affected?

  • Chainstack customers: Chainstack says the accessed database held account information for its customers. Your organization name, account holder names, member email addresses and password hashes may be among the exposed data (The Hacker News).
  • Node credentials: Chainstack is treating node credentials as exposed, even though it has no evidence they were read.
  • Reused passwords: if you used your Chainstack password on other services, those accounts are also at risk, according to the company’s advice.

Whether every customer or only a subset is affected is not confirmed.

What to do now

These steps are the ones Chainstack advises, as reported by The Hacker News:

  1. Rotate your Chainstack node credentials.
  2. Regenerate your Chainstack platform API keys.
  3. Change your Chainstack password.
  4. Change the password on any other service where you reused your Chainstack password.
  5. Watch for phishing attempts that use your name, organization or email address.

Sources