Chainstack data breach: node customers must rotate keys - CryptoTicker.io
Blockchain infrastructure provider Chainstack has confirmed a data breach in which customer names, email addresses and password hashes were stolen, and is urging all users to rotate their node credentials.
Chainstack, a company that rents blockchain nodes to developers, has confirmed that an external attacker gained access to parts of its infrastructure. The breach, which the company says has been contained, resulted in the theft of customer data including organisation names, account holders' names, email addresses and password hashes.
The company is treating all customers' node credentials as exposed as a precaution, even though it found no evidence that they were read out. Chainstack is asking all users to renew their passwords and regenerate their API keys. Customer services and the management console continued to run normally throughout the incident.
Chainstack does not store payment data such as full card numbers or security codes, so these could not have been taken. The company has not disclosed how many customers are affected, but it says it will notify all users by email.
How the breach happened
The entry point for the attacker was a test instance of the monitoring software Grafana in a development cluster. This instance had been reachable from the internet since July without an additional authentication layer and was still running with default administrator credentials.
From the evening of October 26, the attacker used a Grafana proxy function to reach internal services. This route led to an internal MCP server, which required no authentication and ran with full administrator rights for the cluster.
On October 29, the attacker obtained machine credentials from an automation platform that extended into the production environment. On October 31, the attacker read secrets on a large scale from the production key store, connected to the database network via a compromised VPN key and queried production databases.
Chainstack detected the intrusion on the same day and cut off access. The company observed the last use of a copied access credential on November 2 at 06:28 UTC and completed its investigation that day.
The attack chained together default passwords, publicly reachable admin functions, missing authentication, overly broad permissions and long-lived credentials.
AI agents and a wider wave of attacks
Chainstack attributes the breach to a broader wave of attacks that came to light at the end of October, in which artificial intelligence takes over parts of the work. The company attributes the ARTEX tool to the attacker with high confidence.
ARTEX is an open-source framework that controls several AI agents based on large language models and automates intrusions. Chainstack identified it from naming fragments such as 'artx' and 'artex' that run through the resources the attacker created.
The case is not isolated. The Hacker News reports that blockchain analytics firm Chainalysis also reported an external actor who broke into its systems using agent-based attack techniques. Software provider WorkOS also traced an incident of its own to an ARTEX agent.
For the industry, this is a warning sign. An AI agent scans for open test instances, default passwords and poorly protected interfaces faster and more thoroughly than a human. Mistakes that used to go unnoticed for a long time are now found within days.
What you need to do
For most retail investors, the answer is no. Node access allows you to query data from a blockchain and relay transactions that have already been signed. Only someone holding a wallet's private key can sign. A node provider does not store this key; it stays in your wallet or with your exchange.
The case can still affect you indirectly. Anyone who has their own Chainstack account, even a free one for a hobby project, should change their password. Users of trading bots that let you enter your own RPC endpoint should also regenerate their access keys.
Chainstack has set up a self-service option in the console for the renewal of node credentials. Existing endpoints keep working until a customer has completed the rotation, which is the usual security practice after a breach.
Users of Chainstack's platform interface should also generate new API keys. Such a key can be used to create, modify or delete nodes. Unauthorised access to it could run up costs or disrupt services, even if no coins are involved.
Related
