Chainstack breach: customer account names, emails and password hashes accessed, node credentials treated as exposed
Chainstack said on November 3, 2026 that an attacker who entered through a third-party component reached a customer account database containing organisation names, account holder names, member email addresses and password hashes, and had access to systems holding node credentials, which the company is treating as exposed; it says the incident was part of a broader AI-powered attack campaign reported in late October.
What happened
Chainstack, a blockchain infrastructure provider, published an incident report on November 3, 2026. The company said an external attacker gained unauthorised access to part of its infrastructure through a third-party component, which it has not named. Its timeline: the attacker reached a development environment on October 26, reached some parts of the production environment on October 29, and was detected on October 31, when Chainstack cut the access paths the same day; the company closed the incident on November 2. Customer-facing services kept operating normally throughout, and Chainstack says its customer nodes, console and API were not modified.
Chainstack also said its findings indicate the incident was part of a broader AI-powered attack campaign reported in late October; The Hacker News assesses that it shares overlaps with the campaign using the ARTEX framework — the same campaign this desk covered at Chainalysis and WorkOS. Chainstack itself does not name ARTEX or an actor in its report.
Who is affected
Chainstack customers. The attacker accessed a database containing customer account information: organisation names, account holder names, the email addresses of organisations’ members on Chainstack, and password hashes. The attacker also had access to systems holding node credentials; Chainstack says it has no evidence those credentials were read, but it is treating them as exposed and asking customers to rotate them. The company does not store payment method details such as full card numbers or security codes, so those were not exposed. Chainstack has given no count of affected customers and is notifying all customers by email.
How serious
The concrete risks are account takeover and targeted phishing. Password hashes can be cracked offline — fastest where the original password was weak or reused — and a working Chainstack password, or the same password reused elsewhere, opens the account and anything it controls. Real names and work email addresses from the database are also raw material for phishing that impersonates Chainstack’s own incident emails. Node credentials, if they were in fact read, could be misused against the blockchain nodes they protect, which is why the company is treating them as exposed rather than waiting for proof.
What to do now
Follow Chainstack’s instructions: change your Chainstack password, and change the same password anywhere else you reused it. Rotate your node credentials — the company says self-service rotation is available in the console and current endpoints keep working until rotation is complete. Regenerate your platform API keys if you use the platform API. Watch for phishing: Chainstack says it will never ask for passwords, tokens or keys, so treat any message that does as fake, and reach the console through the address you type yourself, not a link in an email.
Sources: Chainstack incident report, November 3, 2026 · The Hacker News, November 3, 2026