Case chainstack-ai-campaign-breachAI-assisted malwareWorldwide
Chainstack discloses production breach exposing customer data and password hashes
Blockchain infrastructure provider Chainstack disclosed that an external attacker reached its development environment on 26 Oct 2026 and some production systems on 29 Oct through a third-party component. The intrusion was detected and cut off on 31 Oct. The attacker accessed a database of customer account information including password hashes, plus systems holding node credentials. The company says its findings indicate the incident was part of a broader AI-powered attack campaign, which The Hacker News says overlaps with a China-linked cluster using ARTEX.
HighAttack using AIStatus: contained; investigation closed 2 Nov 2026Verified case file
Open in the interactive mapCite this case
- Reported
- Nov 3, 2026
- Location
- Worldwide
- Target
- Chainstack production infrastructure
- Severity
- High
- Verification
- Reported by credible press or researchers
- Triggered by
- Unknown
- Actor type
- Unknown
- Sector
- Technology & AI vendors
- Reported loss
- None reported
- CVE
- None
What happened
Blockchain infrastructure provider Chainstack disclosed that an external attacker reached its development environment on 26 Oct 2026 and some production systems on 29 Oct through a third-party component. The intrusion was detected and cut off on 31 Oct. The attacker accessed a database of customer account information including password hashes, plus systems holding node credentials. The company says its findings indicate the incident was part of a broader AI-powered attack campaign, which The Hacker News says overlaps with a China-linked cluster using ARTEX.
Impact: Organization names, account holder names, member email addresses and password hashes may have been exposed. Node credentials are treated as exposed, with no evidence they were read. Customer nodes, console and API were not modified.
Who triggered it
Actor: Unknown
Attribution: Unattributed; assessed as part of a large-scale AI-powered attack campaign.
Motive: Unknown
How it happened
Attack vector: Unauthorized access to parts of Chainstack's infrastructure; exact method Unknown.
Root cause: Unknown
Timeline
- Reported by The Hacker News
Response
Chainstack cut the access paths, hardened its systems and emailed customers. It asked them to change passwords, rotate node credentials and regenerate platform API keys.
Current status: contained; investigation closed 2 Nov 2026
Research warnings this case matches
- Seen in real incidents AI makes cyberattacks easier, faster and larger · CAIS
- Seen in real incidents Criminals and state hackers use AI in cyberattacks · International AI Safety Report
- Seen in real incidents Malicious actors and misuse · MIT AI Risk Repository
Compared with published AI risk research from several institutes on the Research vs reality page.
Sources (open in a new tab)
- The Hacker News thehackernews.com
- Chainstack chainstack.com
Cite this case
Chainstack discloses production breach exposing customer data and password hashes. AI Threat Watch, case chainstack-ai-campaign-breach, Nov 3, 2026. https://aithreat.io/cases/chainstack-ai-campaign-breach/
Permanent link: https://aithreat.io/cases/chainstack-ai-campaign-breach/
Related cases
The same type of incident, most recent first.