FHN 
Blockchain infrastructure provider Chainstack has disclosed a cyberattack in which an unauthorized attacker accessed parts of its infrastructure, including production systems and a database containing customer information and password hashes.
The company revealed the incident on November 3, 2026, stating that the attacker gained initial access through a third-party component before moving from a development environment into parts of its production infrastructure.
Attack Timeline
According to Chainstack, the attacker accessed a development environment on October 26, 2026, and subsequently escalated access to parts of the production environment.
The intrusion was detected on October 31, when Chainstack blocked the attacker’s access and began securing its systems.
Customer Information Potentially Exposed
The compromised database contained customer-related information, including:
- Organization names
- Account holder names
- Member email addresses
- Password hashes
The attacker also gained access to systems storing node credentials. Although Chainstack reported no evidence that these credentials were read, the company is treating them as potentially exposed.
The compromised database contained customer-related information, including:
- Organization names
- Account holder names
- Member email addresses
- Password hashes
The attacker also gained access to systems storing node credentials. Although Chainstack reported no evidence that these credentials were read, the company is treating them as potentially exposed.
Customers Urged to Rotate Credentials
Chainstack has advised customers to take precautionary security measures, including:
- Rotate node credentials.
- Regenerate platform API keys.
- Change account passwords, particularly reused passwords.
- Monitor accounts for suspicious activity.
- Remain alert to potential phishing attempts.
Possible Connection to AI-Powered Attack Campaign
The incident is assessed to share links with a broader AI-powered cyberattack campaign involving the ARTEX framework. Other organizations, including WorkOS and Chainalysis, have also reported security incidents involving AI-assisted offensive operations.
However, the specific attack method used against Chainstack has not been publicly detailed, and the company has not confirmed the identity of the attacker.
The incident highlights the growing risks facing blockchain infrastructure providers and the importance of securing third-party components, monitoring production environments, and maintaining strong credential management practices.
About the Author
