Blockchain infrastructure provider Chainstack has disclosed a breach in which an attacker reached parts of its production systems and accessed a database holding customer account details, including password hashes. The company published its account of the incident on 3 November 2026.

According to the timeline Chainstack shared, the attacker first entered a development environment on 26 October through a third-party component, then moved into some production systems on 29 October. The intrusion was spotted on 31 October and the attacker's access was cut off the same day. Chainstack says it finished its investigation and closed the incident on 2 November.

The database the attacker reached held organisation names, account holder names, the email addresses of organisation members, and password hashes. The attacker also had access to systems holding node credentials. Chainstack says it has no evidence those credentials were read, but it is treating them as exposed and has asked customers to rotate them.

Customers are also being told to change their passwords, including on any other service where the same password was reused, to regenerate platform API keys, and to watch for phishing messages. Chainstack says customer-facing services kept running normally throughout, that customer nodes, the console and the API were not modified, and that it does not store payment details such as full card numbers.

The incident is assessed to be part of a wider AI-powered attack campaign that came to light in late October. The Hacker News reports the campaign overlaps with activity by a China-linked cluster using an autonomous AI agent framework known as ARTEX. The same campaign has also been linked to incidents at API platform WorkOS and blockchain analysis firm Chainalysis, which took two of its products offline on 2 November.