Blockchain Infrastructure Provider Chainstack Discloses Attack Technical Details, Customer Account Data Exposed

on November 12, according to disclosures from Chainstack, the blockchain infrastructure provider has updated the technical details regarding a prior security incident. The attacker gained access to the development environment on October 26, partial production environments on October 29, and accessed customer account databases on October 31.

The company stated that potentially exposed data includes organization and account holder names, member emails, and password hashes. The attacker also accessed systems storing node credentials. While there is no evidence that the credentials were read, the company is urging customers to rotate them.

Chainstack noted that the attacker initially breached the system via a Grafana test instance that retained default administrator credentials, then expanded access using an unauthenticated MCP tool server and stolen machine credentials. Investigations found the attacker utilized the ARTEX framework, but no evidence of software vulnerability exploitation was discovered. The company confirmed that customer nodes, consoles, and APIs were not compromised.