Chainstack Discloses Breach of Production Systems; Customer Emails and Password Hashes Accessed

Blockchain infrastructure provider Chainstack has disclosed a security incident involving unauthorized access to its production environment, compromising customer organization names, emails, and password hashes.

Published November 3, 2026. This is a developing story and may be updated.

Blockchain infrastructure provider Chainstack said today that an outside attacker broke into part of its infrastructure, reaching a customer account database and systems that store node credentials.

According to the company’s security notice, the attacker got in through a third-party component. Chainstack has not said which component or what vulnerability was involved.

Timeline

October 26, 2026: The attacker gained access to a development environment.
After that: The attacker widened their access and reached some parts of the production environment.
October 31, 2026: Chainstack detected the intrusion and cut off the attacker’s access the same day.

That puts roughly five days between the initial compromise and detection.

What was accessed

The attacker reached a database of customer account information containing:

Organization names and account holder names
Email addresses of members of organizations on Chainstack
Password hashes

The attacker also had access to systems holding node credentials. Chainstack says it has no evidence those credentials were read, but it is treating them as exposed and asking customers to rotate them.

Possible link to a wider campaign

Chainstack has not published technical details or named a suspected actor. However, The Hacker News reports that the incident is assessed to be part of a broader AI-powered campaign, and that it overlaps with activity by a China-linked cluster using a framework called ARTEX. That attribution comes from outside analysis, not from Chainstack.

The same report notes that WorkOS and Chainalysis have disclosed incidents connected to the same campaign.

What Chainstack customers should do

Chainstack advises customers to:

Rotate node credentials. Treat all active credentials as exposed.
Regenerate platform API keys.
Change account passwords, including on any other service where the same password was reused.
Watch for phishing. Exposed names and email addresses make targeted messages more convincing.

Chainstack says it is hardening its systems. We’ll update this article if the company releases more details.

Sources: Chainstack security notice; The Hacker News