Chainstack breach exposes customer data and password hashes
Blockchain infrastructure provider Chainstack has disclosed a cyber attack in which an unauthorized party accessed parts of its infrastructure, including portions of its production environment. The company said a customer account database was accessed, containing organization names, account-holder names, member email addresses and password hashes.
Chainstack said the attacker also had access to systems holding node credentials. It has found no evidence that those credentials were read, but is treating them as exposed and has asked customers to rotate them. The company detected the intrusion on October 31, 2026, and said it cut off the attacker's access the same day.
Development access preceded production compromise
In its incident timeline, Chainstack said the attacker gained access to a development environment on October 26, 2026. That access was then escalated into some parts of the production environment. Chainstack attributed the initial unauthorized access to a third-party component and said it had cut access paths and was hardening its systems.
The disclosure illustrates why development environments, third-party components and routes between development and production systems need to be considered together during incident response. In this case, the production impact followed an intrusion that began outside the production environment.
Customers advised to replace credentials
Chainstack has advised customers to rotate node credentials, regenerate platform API keys and update passwords. It specifically recommended changing passwords on other services where the same password has been reused, because the accessed database included password hashes.
The company also urged customers to remain alert to phishing attempts. Names, email addresses and organization details can give attackers material for targeted messages even where password hashes cannot be used directly to sign in.
ARTEX campaign linked to other disclosures
Chainstack said the attack is assessed to overlap with a large-scale, AI-powered campaign that emerged the previous week and has been associated with the autonomous AI agent framework ARTEX. The source did not provide technical specifics of Chainstack's intrusion.
API platform WorkOS separately disclosed an ARTEX-related incident detected on October 30, 2026. WorkOS said the event was confined to its go-to-market systems and did not affect production systems or customer platform data, although business contact information, account and relationship records, customer communication summaries, and operational metadata were accessed.
Chainalysis also reported detecting an external actor using offensive agentic techniques against its systems and internal tools. As of November 2, 2026, it had taken its Reactor and Data Solutions products offline proactively while monitoring for unusual activity.
For businesses using Chainstack, the immediate implication is operational: rotate the specified credentials and keys, replace reused passwords, prepare users for phishing, and review third-party dependencies and controls that could permit a development-environment compromise to extend into production.