Blockchain infrastructure provider Chainstack has confirmed an AI-powered security breach that exposed customer names, email addresses, and password hashes. According to the company’s updated security notice published Tuesday, customer-facing services continued to operate normally throughout the incident, and the threat has been contained.
The intrusion timeline began on Oct. 26 when an attacker gained access to a development environment through an internet-exposed Grafana instance that was deployed with default administrator credentials and no additional protection. The attacker then obtained machine credentials, reached parts of the production environment by Oct. 29, and used them to access the database network. Chainstack detected the activity and cut access paths on Oct. 31 before finalizing its investigation on Nov. 2.
Chainstack said the attacker used the ARTEX AI agent framework as part of the operation. Investigators found no unauthorized modifications to customer nodes, console settings, or API services. Nevertheless, the company is treating node credentials as exposed and is notifying customers to rotate them and change passwords. Self-service rotation is available in the console without downtime.
The company also warned customers to watch for phishing attempts, stating: "Chainstack will never ask for passwords, tokens, or keys." The total number of affected customers and any financial losses have not been disclosed. The incident follows a separate AI-era security event in which cross-chain interoperability protocol Across suffered a domain takeover before restoring control of its website and resuming normal operations.
