Chainstack Reveals AI-Driven Cyberattack in Late October 2026, Customer Account Data Compromised

ChainCatcher report: Blockchain infrastructure provider Chainstack disclosed that it suffered an AI-driven cyberattack between October 26 and 31, 2026. The attackers gained access to the development environment through a Grafana instance with unchanged default admin credentials and no single sign-on protection. They then obtained cluster administrator privileges by exploiting an unauthenticated MCP tool server, used an automated platform to steal credentials, and ultimately accessed the production environment to read customer databases. The breach exposed customer account information, including organization names, account holder names, member email addresses, and password hashes. The attackers also gained access to systems storing node credentials; although there is no evidence these were accessed, Chainstack still requires customers to rotate their node credentials. Chainstack stated that customer-facing services remained operational during the incident, and customer nodes, consoles, and APIs were not modified. Investigation revealed the attackers used the open-source framework ARTEX, with no evidence of software vulnerabilities being exploited. Chainstack has severed the attackers’ access paths and advises customers to change passwords, rotate node credentials, regenerate platform API keys, and remain vigilant against phishing attempts.