Chainstack disclosed that it suffered an AI-driven cyber attack at the end of October, resulting in the exposure of customer account information

Blockchain infrastructure service provider Chainstack disclosed that it experienced an AI-driven cyber attack from October 26 to 31, 2026. The attacker accessed the development environment through an unmodified default administrator credential and a Grafana instance without single sign-on protection, subsequently gaining cluster administrator privileges via an unauthenticated MCP tool server and stealing credentials through an automated platform, ultimately accessing the production environment to read the customer database.

This incident resulted in the exposure of customer account information, including organization names, account holder names, member email addresses, and password hashes. The attacker also had access to systems containing node credentials, although there is no evidence that they were read; however, Chainstack still urged customers to rotate their node credentials. Chainstack stated that customer-facing services operated normally during the incident, and customer nodes, consoles, and APIs were not modified. Investigations revealed that the attacker used the open-source framework ARTEX, with no evidence found of exploiting software vulnerabilities. Chainstack has cut off the attack access path and requested customers to change passwords, rotate node credentials, regenerate platform API keys, and remain vigilant against phishing information.