---
title: Chainstack breach: an attacker got in through a third-party component, reached production and an account database with password hashes; customers told to rotate node credentials and API keys | ctxsec
url: https://ctxsec.com/items/chainstack-breach-oct-26-31-account-db-password-hashes-rotate-node-credentials
description: "Blockchain node provider Chainstack says an attacker entered a development environment on Oct 26 through a third-party component, reached parts of production on Oct 29 and was detected and cut off on Oct 31. The attacker accessed a database with organization names, account holder names, members' email addresses and password hashes, and had access to systems holding node credentials. Chainstack has no evidence those were read but is treating them as exposed. Nodes, the console and the API were not modified, and payment card details are not stored."
status: "official (Chainstack incident report, Nov 3). Chainstack ties it to 'a broader AI-powered attack campaign reported in late October' but doesn't name it; links to ARTEX are press assessments"
published: 2026-11-03
---

> Blockchain node provider Chainstack says an attacker entered a development environment on Oct 26 through a third-party component, reached parts of production on Oct 29 and was detected and cut off on Oct 31. The attacker accessed a database with organization names, account holder names, members' email addresses and password hashes, and had access to systems holding node credentials. Chainstack has no evidence those were read but is treating them as exposed. Nodes, the console and the API were not modified, and payment card details are not stored.

[← Cybersecurity News](/news) · [markdown](/items/chainstack-breach-oct-26-31-account-db-password-hashes-rotate-node-credentials.md)

official (Chainstack incident report, Nov 3). Chainstack ties it to 'a broader AI-powered attack campaign reported in late October' but doesn't name it; links to ARTEX are press assessments

2026-11-03

### Chainstack breach: an attacker got in through a third-party component, reached production and an account database with password hashes; customers told to rotate node credentials and API keys

- **Customer actions (Chainstack):** change your Chainstack password and any reused elsewhere; rotate node credentials (new no-downtime rotation in the console replaces the HTTPS/WSS auth token, username/password and gRPC x-token together); regenerate platform API keys; expect phishing, since Chainstack will never ask for passwords, tokens or keys.
- **Context:** Chainstack says the intrusion was part of a broader AI-powered campaign reported in late October. Chainalysis and WorkOS disclosed intrusions in the same period (see our [WorkOS item](/items/workos-oct-30-internal-sales-tool-breach-ai-attack-framework-artex-user-agents)).

If you run RPC endpoints from Chainstack, rotating node credentials matters most: a leaked endpoint token lets someone use your node quota and see your traffic patterns.

Sources: [Chainstack: Incident report: what happened and what customers need to do (Nov 3)](https://chainstack.com/security-incident-nov-2026/) · [Chainstack docs: Rotate node credentials](https://docs.chainstack.com/docs/manage-your-node) · [The Hacker News: Chainstack reports production systems breach](https://thehackernews.com/2026/11/chainstack-reports-production-systems.html)