Chainstack Says AI-Driven Security Breach Exposed Customer Data; Incident Contained

Blockchain infrastructure provider Chainstack said it experienced an AI-powered security breach in late October, during which customer names, email addresses, and password hashes were exposed.

In an updated blog post published Tuesday, Chainstack said it had contained the incident. The company added that its customer-facing services continued operating normally throughout the breach.

Chainstack said the attacker initially accessed a development environment on Oct. 26 and reached parts of the production environment on Oct. 29. The company detected the intrusion and closed the access paths on Oct. 31, then completed its investigation on Nov. 2.

According to the post, the attacker entered the system through an internet-accessible Grafana instance in a development cluster. The instance had been deployed for testing with its default administrator credentials and without an additional layer of protection.

The attacker subsequently obtained machine credentials that provided access to production and used them to reach the database network. Chainstack said the attacker carried out the breach using the ARTEX AI agent framework.

The Block has contacted Chainstack for further comment.

Aftermath

In response to the incident, Chainstack said it is treating node credentials as exposed and is notifying customers that they should rotate those credentials and change their passwords. The company said customer nodes, its console, and its API were not modified. According to the post, customers can currently rotate node credentials themselves through the console without experiencing downtime.

Chainstack also cautioned customers to be alert to phishing attempts. “Chainstack will never ask for passwords, tokens, or keys,” the team said.

The breach occurred amid a broader wave of cyberattacks and security incidents as AI tools continue to grow more capable. Earlier this week, cross-chain interoperability protocol Across experienced a domain takeover, but subsequently regained control of its website and resumed normal operations.