Chainstack Breach Exposes Customer Details and Password Hashes in Suspected AI-Driven Campaign

Chainstack, a blockchain infrastructure provider, has disclosed that an external attacker gained unauthorised access to part of its infrastructure through a third-party component. According to the company's timeline, the attacker entered a development environment on 26 October 2026 and then escalated access to some parts of production. The intrusion was detected on 31 October 2026, and access was cut off the same day.

A database containing customer account information was accessed. It included organisation names, account holder names, the email addresses of organisation members and password hashes. The attacker also had access to systems holding node credentials. Chainstack has no evidence they were read, but is treating them as exposed. The incident is assessed to be part of a large-scale, AI-powered attack campaign that came to light last week, and it appears to overlap with activity by a China-linked cluster using a tool called ARTEX to target high-value firms. Chainstack did not share specifics of the attack.

Customers are advised to rotate node credentials, regenerate platform API keys, update passwords (including any reused on other services) and stay alert to phishing. API platform WorkOS also disclosed an incident involving the same autonomous AI agent framework. It was discovered on 30 October 2026 and was limited to its GTM systems, with no impact on production systems or customer platform data. The cases point to a growing trend of attackers using AI agents to tailor strategies and automate stages of an intrusion.