Chainstack Urges Credential Rotation After Data Breach

Chainstack is asking customers to change passwords and rotate the credentials their applications use to connect to its blockchain nodes after a breach the company says is now contained.

In an incident report dated Nov. 3 and updated Nov. 11, the infrastructure provider said an attacker accessed a customer database. Organization names, account holders’ names, members’ email addresses and password hashes may have been exposed, it said.

The attacker also reached systems holding node credentials. Chainstack said it found no evidence those credentials were read, but is treating them as exposed. Customer-facing services operated normally throughout, and customer nodes, the console and API were not modified, according to the company.

Chainstack dated initial access to its development environment to Oct. 26 and access to parts of production to Oct. 29. It said it cut the access paths on Oct. 31, but some copied credentials for external services kept working until rotated. Their last observed use was Nov. 2, the day Chainstack said it closed the incident.

AI Tooling and Access-Control Gaps

According to Chainstack’s technical account, the attacker entered through an internet-facing test instance of Grafana with unchanged default administrator credentials. From there, the attacker reached an internal AI tool server that required no authentication and had cluster-administrator permissions. Credentials obtained in development also allowed access to production.

Chainstack said the attacker used ARTEX, a framework that coordinates language-model agents to automate intrusions. It cited naming markers in attacker-created resources and parallel attack paths, while stressing that identifying the tooling did not identify the attacker.

“We found no evidence that a software vulnerability was exploited,” the company said. Instead, it described a chain of default credentials, missing authentication and excessive permissions.

Customers Must Complete the Rotation

Node credentials authenticate requests to hosted blockchain nodes, creating a risk of unauthorized node use if copied. Changing an account password is not a substitute for replacing that access.

Chainstack’s rotation guide says customers can generate replacement credentials without downtime, update their applications and then deactivate the old credentials. Both sets remain valid until that final step, with no time limit. Applications still using old credentials will have their requests rejected once those credentials are deactivated.

Customers must rotate each active credential set separately. A node rotation does not change a multichain auth token, which can authorize access across several nodes. Replacing that token requires a separate workflow: create a new multichain endpoint, attach the same nodes, switch applications to its token and delete the old endpoint.

Chainstack also asked customers to change passwords anywhere they reused their Chainstack password, regenerate platform API keys if they use the platform API, and watch for phishing. “Chainstack will never ask for passwords, tokens or keys,” the company said.