Chainstack says attacker reached production systems and a database holding customer emails and password hashes

TLDR

• Chainstack says an attacker reached its development environment on 26 October and was cut off on 31 October.¹
• Chainstack says the attacker accessed a database with organisation names, holder names, member emails and password hashes.¹
• Chainstack treats node credentials as exposed and asks customers to rotate them, regenerate platform API keys and change passwords.¹

Blockchain infrastructure provider Chainstack published an incident report on 3 November saying an external attacker gained unauthorised access to part of its infrastructure through a third-party component.¹² The company says it detected the intrusion, cut the access paths and is hardening its systems.¹ Customer-facing services continued to operate normally, and customer nodes, the console and the API were not modified.¹ Chainstack says it does not store payment method details such as full card numbers or security codes, so they were not exposed.¹

Chainstack's timeline has the attacker in a development environment on 26 October and in some parts of production on 29 October, with the intrusion detected and access cut on 31 October and the investigation closed on 2 November.¹ The Hacker News reports the 26 October development access and the escalation into production, and gives 31 October for detection and cut-off, without the 29 October production date.² It adds that Chainstack did not disclose specifics about the attack.²

The attacker accessed a database containing customer account information, and the information that may have been exposed includes organisation names, account holder names, the email addresses of organisation members and password hashes, Chainstack says.¹ The attacker also had access to systems holding node credentials: "We have no evidence they were read, but we are treating them as exposed and ask customers to rotate them."¹ Chainstack is notifying all customers by email and asking them to change passwords, including any reused elsewhere, to rotate node credentials, and to regenerate platform API keys if they use the platform API.¹ It says self-service rotation is now available in the console and that current endpoints keep working until customers finish rotating, and it warns that it will never ask for passwords, tokens or keys.¹

On attribution, Chainstack says its findings indicate the incident was part of a "broader AI-powered attack campaign reported in late October", adding that this does not change its responsibility for what happened in its environment.¹ The page text itself names no framework or threat actor.¹ The Hacker News says the incident is assessed to share overlaps with a campaign by a China-linked cluster targeting high-value firms with ARTEX, an autonomous AI agent framework, but does not say who made that assessment.² Elsewhere in the same report, The Hacker News says API platform WorkOS disclosed an incident discovered on 30 October that was limited to its GTM systems and did not affect production systems or customer platform data.² BleepingComputer reports that WorkOS's founder said the attacker used the ARTEX AI penetration testing suite.³ Chainalysis, which disclosed its own breach on 30 October, described an external actor using "offensive agentic techniques", and its notice names no framework or actor.⁴

Why it matters: a node infrastructure provider says an attacker reached systems holding customer node credentials as well as password hashes, so customers have to rotate secrets themselves, while the China-linked ARTEX link comes from The Hacker News's assessment rather than from Chainstack's own page.¹²