Chainstack says AI-powered security breach exposed customer data; threat now contained

Blockchain infrastructure provider Chainstack revealed it experienced an AI-powered security breach in late October that exposed customer names, emails, and password hashes.

In an updated blog post on Tuesday, Chainstack said the incident has been contained and that customer-facing services continued to operate normally throughout the breach.

The company noted that an attacker first gained access to a development environment on Oct. 26, and reached parts of the production environment on Oct. 29. The firm then detected the intrusion and cut the access paths on Oct. 31. It later finalized the investigation on Nov. 2.

According to the post, the attacker accessed the system via an internet-exposed Grafana instance in a development cluster that was deployed for testing with its default administrator credentials and without an additional layer of protection.

The attacker then obtained machine credentials that reached production, and used them to access the database network. Chainstack said the attacker used the ARTEX AI agent framework to carry out the breach.

The Block has reached out to Chainstack for further comment.

Aftermath

Following the incident, Chainstack said it is currently treating node credentials as exposed and notifying customers to rotate them and change passwords. The company added that customer nodes, console, and API were not modified. Self-service rotation for node credentials is currently available in the console without downtime, per the post.

Chainstack also warned customers to watch for phishing attempts. "Chainstack will never ask for passwords, tokens, or keys," the team said.

The incident comes amid a wave of cyberattacks and security breaches as AI tools become increasingly capable. Earlier this week, crosschain interoperability protocol Across suffered a domain takeover, and later restored control of its website and resumed normal operations.