Blockchain infrastructure provider Chainstack reports an intrusion that exposed customer account data and password hashes
November 3, 2026 (Access October 26; detected October 31; disclosed November 3, 2026)
Chainstack, a company that provides blockchain nodes and APIs to developers, disclosed that an outside attacker got into part of its infrastructure through a third-party component. The attacker first reached a development environment on October 26, then moved into parts of production. Chainstack detected the intrusion on October 31 and cut off the attacker's access the same day. A customer account database was exposed, holding organization names, account holder names, member email addresses and password hashes. Systems holding node credentials were also reached. Chainstack has no evidence that those credentials were read but is treating them as exposed. The Hacker News reports that the incident is assessed to be part of a large-scale, AI-powered campaign reported the week before. Chainstack has not given further technical detail and has not said how many customers are affected. It is hardening its systems and asks customers to rotate node credentials, regenerate platform API keys and update passwords, including any reused elsewhere.
Why it matters
Node credentials and API keys are how customers connect applications to blockchain networks, so they should be replaced even without proof of misuse. Password hashes can be cracked if passwords were weak or reused, and customer emails give scammers a ready list to target.
What defenders can take from it
- Chainstack customers: rotate node credentials, regenerate platform API keys and change your password, and anywhere else you reused it.
- Be alert to phishing that mentions Chainstack, your nodes or an account reset, and go to the provider's own site instead of using a link in a message.
- Companies that depend on infrastructure providers: keep an inventory of the keys and credentials you have given them, so you can replace all of them quickly.