Overview
Blockchain infrastructure provider Chainstack disclosed on Tuesday that an unauthorized party gained access to parts of its infrastructure. The company says the incident was discovered on October 30, 2026, and is assessed to be part of a large-scale, AI-powered attack campaign that came to light last week.
What Was Exposed
According to reporting, the attacker reached a database holding:
- Organization names
- Account holder names
- Member email addresses
- Password hashes
Chainstack also acknowledged the attacker had access to systems holding node credentials, which are particularly sensitive for a company that hosts blockchain nodes for customers.
Open Questions
Reports are inconsistent about scope. The headline of the original coverage refers to production systems, while the body says the incident was limited to Chainstack's go-to-market (GTM) systems and did not affect production systems or customer platform data. Chainstack has not published technical details. Treat the scope as unconfirmed until a full incident report appears.
The incident is assessed to overlap with a campaign by a China-linked cluster that targets high-value firms using an AI-driven tool. Chainalysis separately disclosed a breach in which attackers used "offensive agentic techniques" to access internal systems, suggesting a wider campaign against crypto-sector vendors.
Recommendations for Chainstack Customers
- Reset your Chainstack password and any account where it was reused.
- Enable MFA on the Chainstack account and on linked identity providers.
- Rotate node credentials and API keys, including any endpoints embedded in applications or CI.
- Review access logs for unusual node or API usage since late October.
- Watch for phishing that references Chainstack, since names and emails were exposed.
Takeaways
- Password hashes are not safe to ignore. Weak or reused passwords can be cracked offline.
- Vendors in the crypto supply chain are high-value targets, and AI-assisted intrusion is shortening dwell time before discovery.
- Credentials stored in a hosting provider's back office should be treated as exposed in any breach there.