Chainstack Reveals AI-Driven Cyberattack in Late October 2026, Customer Data Compromised

Mars Finance reports that blockchain infrastructure provider Chainstack disclosed it suffered an AI-driven cyberattack between October 26 and 31, 2026. The attackers gained access to the development environment through a Grafana instance with unchanged default admin credentials and no single sign-on protection. They then obtained cluster administrator privileges by exploiting an unauthenticated MCP tool server, used an automated platform to steal credentials, and ultimately accessed the production environment to read customer databases. The breach exposed customer account information, including organization names, account holder names, member email addresses, and password hashes. The attackers also gained access to systems storing node credentials; although there is no evidence the data was read, Chainstack has requested customers rotate their node credentials. Chainstack stated that customer-facing services remained operational during the incident, with no modifications made to customer nodes, consoles, or APIs. Investigation revealed the attackers used the open-source framework ARTEX, with no evidence of software vulnerabilities being exploited. Chainstack has severed the attackers’ access paths and has instructed customers to change passwords, rotate node credentials, regenerate platform API keys, and remain vigilant against phishing attempts.