Chainstack says hackers got into its systems and customer data

Blockchain infrastructure company Chainstack says hackers broke into parts of its systems and reached customer account data. The company disclosed the attack on Tuesday. It says the attacker got in through a third-party component, meaning a piece of outside technology it relies on. Chainstack has cut off the access and is strengthening its systems.

What happened

According to Chainstack's timeline, the attacker got into a development environment on October 26, 2026. That is the area where software is built and tested. The attacker then moved up to reach some parts of the live production environment. Chainstack spotted the intrusion on October 31 and cut off the access the same day.

What was exposed

The attacker accessed a database of customer account information. A password hash is a scrambled version of a password, not the password itself, but it is still something attackers can try to crack.

• Organization names
• Account holder names
• Email addresses of organization members on Chainstack
• Password hashes

The attacker also had access to systems holding node credentials. These are the logins used to connect to a customer's blockchain nodes. Chainstack says it has no evidence they were read, but it is treating them as exposed.

What to do

Chainstack is asking customers to take several steps. Anyone who reused a Chainstack password on another service should change it there too.

• Rotate node credentials, which means replacing them with new ones
• Regenerate platform API keys
• Update passwords, including any reused elsewhere
• Stay alert for phishing emails

A wider campaign

Chainstack says the incident appears to be part of a large attack campaign powered by artificial intelligence that came to light last week. It overlaps with activity by a China-linked group that targets high-value companies using a tool called ARTEX. Chainstack did not share specifics about how the attack worked.

Others have reported similar incidents. API platform WorkOS found a breach on October 30, limited to its go-to-market systems, with no effect on production systems or customer platform data. Chainalysis took its Reactor and Data Solutions products offline as of November 2. The Dutch Institute for Vulnerability Disclosure was hit on September 21.

What is not known yet

Chainstack has not said how many customers were affected. It has not said who is behind the attack beyond the overlap with the ARTEX campaign. It says it is still hardening its systems.