On 3 November 2026, the blockchain infrastructure provider Chainstack published an incident report saying an external attacker had gained unauthorised access to part of its infrastructure through a third-party component. According to Chainstack, the attacker got into a development environment on 26 October, reached parts of production on 29 October and was detected and cut off on 31 October. The attacker accessed an account database holding organisation names, account holder names, member email addresses and password hashes, and "also had access to systems holding node credentials". Chainstack says it has no evidence the node credentials were read but is treating them as exposed. It asked customers to change passwords, rotate node credentials and regenerate platform API keys. Chainstack says its findings indicate the incident was part of a broader AI-powered attack campaign reported in late October. It has not named the third-party component or the attacker.
Key takeaways
- Chainstack disclosed on 3 November 2026 that an attacker entered through a third-party component, moved from a development environment on 26 October into parts of production on 29 October, and was cut off on 31 October.
- The attacker had access to systems holding customer node credentials. Chainstack says: "We have no evidence they were read, but we are treating them as exposed."
- An account database with organisation names, account holder names, member emails and password hashes was accessed. Customer nodes, the console and the API were not modified, according to Chainstack.
- Chainstack links the incident to "a broader AI-powered attack campaign reported in late October" but has not named the component, the actor or the tool.
- The identity lesson: node credentials and platform API keys are bearer secrets for customers' blockchain access. A path from development into production systems that store them turned a supplier weakness into a customer rotation event.
At a glance
| Organisation | Chainstack, a managed blockchain node and infrastructure provider, and its customers |
|---|---|
| When | Development environment accessed 26 October 2026; production reached 29 October 2026; detected and access cut 31 October 2026; investigation closed 2 November 2026; first public disclosure 3 November 2026 |
| Attacker | Unnamed external attacker. Chainstack says the incident was part of a broader AI-powered attack campaign reported in late October; it does not name a group |
| Entry point | A third-party component (not identified), giving access first to a development environment |
| Identities abused | Customer node credentials (treated as exposed), platform API keys (regeneration advised), account password hashes |
| Impact | Account database accessed (organisation names, account holder names, member emails, password hashes); access to systems holding node credentials, with no evidence they were read; no modification of nodes, console or API, per Chainstack |
| Category | NHI. Incident class: confirmed NHI breach (systems holding node credentials accessed; credentials treated as exposed; entry through a third-party component) |
What happened
Chainstack runs managed blockchain nodes and RPC endpoints for developers and businesses building on networks such as Ethereum and Solana. Customers reach their nodes using node credentials, typically embedded in endpoint URLs or authentication headers, and manage the platform through a console and a platform API that uses API keys. Those credentials are machine secrets. They sit in customers' applications, wallets, back-end services and CI pipelines, and anyone holding them can send requests to the customer's node as if they were the customer.
In its incident report of 3 November 2026, Chainstack wrote: "An external attacker gained unauthorized access to part of Chainstack's infrastructure through a third-party component." According to the report, the attacker reached a development environment on 26 October and some parts of production on 29 October. Chainstack says it detected the intrusion on 31 October and cut the access paths the same day, then finalised its investigation and closed the incident on 2 November. The attacker accessed an account database containing organisation names, account holder names, member email addresses and password hashes. Chainstack also says that "The attacker also had access to systems holding node credentials", adding: "We have no evidence they were read, but we are treating them as exposed." Chainstack says it does not store full payment card numbers or security codes, and that customer nodes, the console and the API were not modified.
Chainstack asked customers to take four steps: change their password, including anywhere else the same password was used; rotate node credentials, which it says can be done in the console without downtime because current endpoints keep working until rotation is complete; regenerate platform API keys if they use the platform API; and watch for phishing. It stated: "Chainstack will never ask for passwords, tokens or keys."
On attribution, Chainstack says: "Our findings indicate that this incident was part of a broader AI-powered attack campaign reported in late October." The link in that sentence points to The Hacker News report of 30 October on a China-based group, tracked by CrowdStrike as Vapor Panda, using the AI-powered ARTEX framework against more than 200 organisations. Chainstack's text does not name ARTEX or Vapor Panda, and it has not said which evidence ties its incident to that campaign. The Hacker News, reporting Chainstack's disclosure on 3 November alongside incidents at WorkOS and Chainalysis, also described the incidents as part of a wider AI-powered campaign. WorkOS's case was later attributed to a researcher's agent rather than a malicious actor, so readers should not assume one actor behind all of them.
Timeline
| Date | Event |
|---|---|
| 26 October 2026 | Attacker gains access to a Chainstack development environment through a third-party component. |
| 29 October 2026 | Attacker reaches some parts of production, including an account database and systems holding node credentials. |
| 30 October 2026 | The Hacker News reports CrowdStrike and Zscaler research on an ARTEX-driven campaign against more than 200 organisations. |
| 31 October 2026 | Chainstack detects the intrusion and cuts the attacker's access paths. |
| 2 November 2026 | Investigation finalised and incident closed, according to Chainstack. |
| 3 November 2026 | Chainstack publishes its incident report and asks customers to rotate credentials. |
How it happened: the identity attack path
- Third-party component as the way in. The attacker gained access through a third-party component. Chainstack has not said whether this was a software dependency, a hosted service or a vendor integration.
- Development environment compromised. The first foothold, on 26 October, was a development environment.
- Pivot from development to production. Three days later the attacker reached parts of production. Chainstack has not said what credential or path allowed the move, which is the key identity question in this incident.
- Account data accessed. In production the attacker accessed an account database including member emails and password hashes.
- Node credential systems within reach. The attacker had access to systems holding customer node credentials. With no evidence either way that they were read, Chainstack treated every node credential as exposed and asked for rotation, along with platform API keys.
Impact
- Confirmed: Access to an account database holding organisation names, account holder names, member email addresses and password hashes.
- Treated as exposed: Customer node credentials, held on systems the attacker could access; Chainstack has no evidence they were read. Platform API keys should be regenerated.
- Not affected, per Chainstack: Full payment card data (not stored); customer nodes, the console and the API were not modified.
- Potential: Unrotated node credentials could allow use of a customer's node capacity or reading of the traffic a customer sends through it, and password hashes may be targeted for cracking and reuse on other services. There is no public evidence of either.
- Undisclosed: The number of affected customers, the third-party component, and how the attacker moved from development to production.
What this means for NHI and AI agent security
This is an NHI breach because the credentials that matter most are not people's passwords but the node credentials and API keys that customers' software uses to reach their blockchain infrastructure. Those secrets were stored by the provider and the attacker could reach the systems that held them. Chainstack chose the cautious route, treating all of them as exposed, and made rotation possible without downtime, which lowers the cost of doing the right thing. It is the same pattern seen in the October attacks on deployment platforms such as Railway and Northflank: platforms that hold customers' machine secrets are targets because one breach yields many keys.
The step that most deserves attention is the move from a development environment into production. Development systems often hold credentials or trust relationships that reach further than intended. Separating identities by environment, so that nothing issued for development can act on production, is a core control. Our Secrets Management Guide covers that separation, and the OWASP NHI Top 10 NHI3 Vulnerable Third-Party NHI Guide covers the third-party side.
Chainstack also links the incident to an AI-powered campaign. Whether or not that link is confirmed in detail, the timing matches a wave of late October and early November intrusions at platform companies, including Chainalysis and GitBook, and the Vapor Panda ARTEX campaign. Agent-driven attackers move quickly from one foothold to the next secret, so the gap between first access and detection, five days here, matters more than ever.
Recommendations
- Rotate node credentials and API keys now. Chainstack customers should rotate every node credential, regenerate platform API keys and confirm old values no longer work. See our Leaked Credential Response Playbook.
- Change reused passwords. Reset the Chainstack password and any other account that shares it, and turn on multi-factor authentication where offered.
- Separate development and production identities. Make sure no credential, role or trust from a development environment can act on production systems that hold customer secrets. See our Secrets Management Guide.
- Govern third-party components. Inventory the components and services that run inside your environments, limit what identities they can use, and monitor them for change. See our OWASP NHI Top 10 NHI3 Vulnerable Third-Party NHI Guide.
- Design for painless rotation. Providers that store customer secrets should support rotation without downtime, as Chainstack did, so customers act quickly. See our API Key Management Guide.
- Shorten detection time. Alert on new access paths from development to production and on bulk reads of credential stores. See our ITDR Guide.
Frequently asked questions
Were Chainstack node credentials stolen?
Chainstack says the attacker had access to systems holding node credentials, but that it has no evidence they were read. It is treating them as exposed and has asked customers to rotate them. Customer nodes, the console and the API were not modified, according to Chainstack.
How did the attacker get into Chainstack?
Chainstack says the attacker gained access through a third-party component, first reaching a development environment on 26 October 2026 and then parts of production on 29 October. It has not named the component or explained how the attacker moved from development into production.
Is the Chainstack breach linked to the ARTEX AI attacks?
Chainstack says its findings indicate the incident was part of a broader AI-powered attack campaign reported in late October, and its report links to coverage of the ARTEX campaign. Chainstack's own text does not name ARTEX or any threat group, and it has not published the evidence behind the link.
Related NHI Mgmt Group resources
Chainalysis breach 2026 · Vapor Panda ARTEX campaign 2026 · Railway breach 2026 · Secrets Management Guide · Leaked Credential Response Playbook
How NHI Mgmt Group can help
Providers that hold customers' machine secrets carry their customers' risk as well as their own. NHI Mgmt Group helps platform teams separate identities across environments, govern third-party components and build rotation that customers can run without downtime, and helps customers keep track of the provider credentials embedded in their systems. See our NHI and AI agent security training.
References
- The Hacker News: Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide (30 October 2026)
- Chainstack: Incident report: what happened and what customers need to do (3 November 2026)
- The Hacker News: Chainstack Reports Production Systems Breach Exposing Customer Data and Password Hashes (3 November 2026)