Chainstack: AI-Driven Intrusion Exposed Customer Data

Blockchain infrastructure provider Chainstack disclosed on Nov. 12 a breach that ran from Oct. 26 to Oct. 31, 2026. The attacker entered a development environment and then reached production. Customer names, email addresses and password hashes leaked, and node credentials are being treated as exposed. Chainstack says customer nodes, the console and the API were not modified, and services stayed online.

Details

According to Chainstack's incident report, the attacker got in on Oct. 26 through an internet-exposed Grafana instance in a development cluster that still used default administrator credentials. Through Grafana's data-source proxy the intruder reached an unauthenticated Kubernetes tool server with cluster-admin privileges. On Oct. 29, using compromised machine identities, the attacker moved into production. The company says an agentic AI framework called ARTEX orchestrated the intrusion.

Chainstack detected the activity and cut access paths on Oct. 31; bulk secret reads took place between 01:40 and 08:31 that day, it says. The investigation was finished on Nov. 2. Exposed data includes organization names, account holder names, emails and password hashes. The company does not store full card numbers. There is no evidence node credentials were read, but they are treated as exposed. The number of affected customers was not disclosed; The Block also reported the incident.

Customers are asked to change passwords, rotate node credentials and regenerate platform API keys, which can be done self-service without downtime, and to watch for phishing. Chainstack says it will never ask for passwords, tokens or keys.

What this means for the market

Chainstack supplies node access to wallets, exchanges and DeFi projects, so leaked node keys raise the risk of request abuse and phishing rather than direct theft. The company's disclosure mentions no loss of crypto assets.

The entry path is the lesson: a basic configuration mistake plus an automated AI tool cut the route from development to production to about three days. Teams that rely on Chainstack nodes should rotate keys without waiting for an email. For current prices, see the daily brief. This is not investment advice.