Blockchain infrastructure provider Chainstack has confirmed a data breach in which an external attacker gained access to its development environment and parts of its production systems through a third-party component. The company said the intrusion was part of a broader AI-powered attack campaign reported in late October, and it is now telling customers to change passwords, rotate node credentials and regenerate API keys.
Chainstack runs managed blockchain nodes and RPC APIs for developers and businesses building on networks such as Ethereum, Solana and other chains. Node credentials are the access tokens and endpoints customers use to reach that infrastructure, which makes the company’s decision to treat them as exposed a significant one for anyone running workloads on the platform.
Eight days from first access to containment
According to Chainstack’s incident notice, published on November 3, 2026, the attacker first accessed the development environment on October 26. By October 29, the intruder had reached parts of the production environment. Chainstack said it detected the activity on October 31 and cut off the attacker’s access the same day.
The company said its investigation was finalized and the incident closed on November 2. Chainstack also acknowledged that the wider campaign does not lessen its own role, writing in its notice: “That does not change our responsibility.”
What Chainstack says was exposed
Chainstack listed the following data as accessed by the attacker:
- Organization names
- Account holder names
- Email addresses of organization members
- Password hashes
The company also said the attacker had access to systems holding customer node credentials. Chainstack stated it found no evidence those credentials were read, but it is treating them as exposed out of caution.
Chainstack said customer services kept running normally during the incident and that customer nodes, the console and the API were not modified. The company does not store payment card data, so no card information was involved.
Steps customers are being asked to take
Chainstack is notifying all customers by email and has asked them to take the following actions:
- Change your Chainstack password, and change it anywhere else the same password was reused.
- Rotate node credentials using the self-service rotation option in the console, which Chainstack says works without downtime. Instructions are in the Chainstack node management documentation.
- Regenerate platform API keys used to manage your account and infrastructure.
- Watch for phishing that references the incident. Chainstack said it will never ask customers for passwords, tokens or keys.
Because names, emails and organization details were taken together, customers should expect convincing follow-up emails that impersonate Chainstack support. Readers who want to check whether their address or reused password has appeared in other incidents can use our guide on how to check if your email, phone or password was in a data breach.
Part of a wider wave hitting developer platforms
Chainstack did not name the group behind the late October campaign in its notice. The disclosure lands days after a string of similar reports from technology and crypto firms. Identity platform WorkOS published a security bulletin on November 2 saying it identified unauthorized access to an internal sales team application on October 30 and citing the “use of an AI-assisted offensive security framework to automate reconnaissance and exploitation attempts.” WorkOS said the exposed data included business contact details, account history, summaries of sales calls and customer support conversations, and that it found no evidence its production systems or application data were accessed.
The pattern matches recent BreachNews coverage of Chainalysis confirming a breach after an attacker used offensive agentic techniques and the Northflank breach tied to the Black October wave against AI developer platforms. Researchers have linked parts of this activity to the ARTEX framework described in our report on the Vapor Panda ARTEX AI agent espionage campaign, although Chainstack itself has not publicly attributed its incident to any specific actor.
Chainstack has not said how many customers or organizations were affected, or which third-party component the attacker used to get in. BreachNews will update this story if the company shares more details.
