Chainstack Says an AI-Driven Breach Exposed Customer Data and Password Hashes

Published November 12, 2026, 2:15 PM PKT. Based on Chainstack's incident report, first published November 3, 2026 with technical details added November 10, 2026 (primary source), and reporting by The Block, Crypto Times and KuCoin News on November 12, 2026 (secondary sources). Chainstack has not disclosed how many customer accounts were affected, and no customer funds were reported stolen.

Blockchain infrastructure provider Chainstack said an attacker used an AI-driven attack framework to break into its systems in late October, reaching production infrastructure and accessing a customer account database that held organization names, account holder names, member email addresses and password hashes.

Chainstack published its incident report on November 3, 2026, added technical details and indicators of compromise on November 10, and the disclosure drew wider coverage on November 12, when The Block reported the breach. The company said the intrusion was contained, customer-facing services kept running normally throughout, and no customer nodes, console or API were modified. It has not said how many accounts were affected.

Bitcoin ($BTC) traded near $73,600 on November 12, 2026, little changed on the day, while the disclosure circulated.

The breach ran through a test Grafana server

The attacker entered through a Grafana monitoring instance deployed for testing in a development Kubernetes cluster in July 2026, according to Chainstack's report. The instance was reachable from the internet, its default administrator credentials had never been changed, and it had no extra layer of protection such as single sign-on or basic authentication.

From 19:26 UTC on October 26, the attacker used Grafana's data-source proxy as a pivot into the cluster network, pointing data sources at internal addresses and, over about two hours, connecting to dozens of internal services, including identity, database, automation and monitoring endpoints. The proxy had no destination allowlist, and no network policy restricted where Grafana could connect.

At 21:01 the same evening, the attacker reached an internal MCP tool server, a service that exposes Kubernetes operations to AI agents. It required no authentication and ran with a service account bound to cluster-admin rights. Over the next hour and a half, the attacker tested write access to an internal workflow engine, created administrator users in the development identity provider, deployed a test web page, and replaced the JavaScript served by a development web application. On October 27, the same technique was applied to the staging web application and to the development Grafana itself.

From development to production in five days

By the morning of October 29, development cloud credentials and an API key for Chainstack's internal business-intelligence tool were already in use from an attacker-controlled address. Between 17:03 and 17:12 that day, the attacker rewrote a workflow in the company's workflow-automation platform directly in the platform's database so that it ran shell commands, triggered it with a valid webhook token, and then restored the original. The run returned the automation pod's environment, its Kubernetes service-account token and a machine identity for the infrastructure access gateway.

That machine identity was used from a second attacker address at 17:08, and by 17:49 the attacker was listing secrets from a production Kubernetes cluster. On October 31, the attacker read secrets in bulk from the production cloud secrets manager between 01:40 and 08:31, created new keys and identities as an independent way back in, ran short-lived pods in production, and installed a relay as a static pod that forwarded local traffic to an external address.

Detection came the same day. Secrets read by the attacker included the private key of a VPN peer on the database network, and when the attacker used that key, the tunnel endpoint flapped between two clients with the same peer identity and a database replication pipeline failed. That failure started Chainstack's investigation. From about 07:30, the attacker connected to a production database as an administrative user and exfiltrated query results through pod command output in base64 chunks. Between 10:39 and 10:43, the attacker queried PostgreSQL's pg_shadow view, which holds role password hashes, on one instance. Chainstack said it cut the access paths on October 31, finalized the investigation on November 2, and observed the last use of a copied credential at 06:28 on November 2.

What was exposed, and what was not

The attacker accessed a database containing customer account information. Information that may have been exposed includes organization names, account holder names, the email addresses of organization members on Chainstack, and password hashes, according to the report.

The attacker also had access to systems holding node credentials. Chainstack said it has no evidence those credentials were read, but it is treating them as exposed and asking customers to rotate them. Customer nodes, the console and the API were not modified, the company said, and it does not store full payment card numbers or security codes, so those were not exposed. Chainstack has not disclosed a victim count, and no theft of customer funds has been reported.

The company is notifying all customers by email and asking them to change passwords, including on any other services where they reused the same password, rotate node credentials through self-service rotation in the console, regenerate platform API keys, and watch for phishing messages. Chainstack said it will never ask customers for passwords, tokens or keys.

The ARTEX fingerprint

Chainstack said it assesses with high confidence that the attacker used ARTEX, an open-source framework that orchestrates large language model agents to automate intrusions. Attacker-created resources consistently carried artx and artex prefixes, including artex-i37257 style names, and the attacker tunneled through chisel, a tool that security researchers also associate with ARTEX operators. Many attack paths ran in parallel, with rapid retries, and with test writes and throwaway DNS records used only to check capabilities.

The company said the incident was part of a broader AI-powered attack campaign reported in late October, but the link is the tooling, the same framework, the same naming markers and some of the same techniques. Public reporting ties ARTEX to several unrelated groups, so the report does not identify who was behind this intrusion or show that the same operators were involved. Chainstack said it found no evidence that a software vulnerability was exploited. The attack chained default credentials, exposed administrative functionality, missing authentication, over-broad permissions and long-lived credentials.

What to watch next

Three things decide how this plays out. The first is whether any customer reports harm: password hashes and node credentials in attacker hands raise the risk of credential-stuffing and phishing attempts against Chainstack customers, and the company has warned customers to expect them. The second is whether other infrastructure providers disclose similar intrusions, since Chainstack links the attack to a wider AI-powered campaign and the same ARTEX markers have appeared in public reporting about other targets. The third is the hardening: Chainstack said it will enforce stricter credential policies, likely mandating multi-factor authentication and eliminating default passwords on all test servers, and the incident is a test of whether that closes the gaps the attacker chained together.

Sources

• Chainstack, Incident report: what happened and what customers need to do, first published November 3, 2026, technical details added November 10, 2026 (primary source: entry through a test Grafana instance with default administrator credentials; unauthenticated MCP tool server with cluster-admin rights; production access on October 29 and 31; customer account database accessed, organization names, account holder names, member email addresses and password hashes possibly exposed; node credentials treated as exposed; ARTEX framework assessed with high confidence; no software vulnerability exploited; customers told to change passwords, rotate node credentials and regenerate API keys)
• The Block, Chainstack says AI-powered security breach exposed customer data; threat now contained, November 12, 2026 (secondary source: breach in late October exposed customer names, emails and password hashes; attacker entered October 26, reached production October 29, intrusion detected and access cut October 31, investigation finalized November 2; customer nodes, console and API not modified)
• Crypto Times, Chainstack Hit by AI-Driven ARTEX Breach Exposing Customer Data and Password Hashes, November 12, 2026 (secondary source: incident report published November 3, technical findings and indicators of compromise added November 10, page last updated November 11; customers asked to change passwords, rotate node credentials and regenerate platform API keys)
• KuCoin News, Blockchain infrastructure provider Chainstack discloses attack details; customer data exposed, November 12, 2026 (secondary source: attacker accessed the development environment October 26, partially entered production October 29, accessed the customer account database October 31; entry through a Grafana test instance with default admin credentials, expanded through an unauthenticated MCP tool server and stolen machine credentials; ARTEX framework used, no software vulnerability exploitation found)

This article is news reporting and is not investment advice.