Chainstack Hit by AI-Powered Cyberattack: Customer Data Exposed

Potentially affected data includes organization names, account owners' names, organization members' email addresses, and password hashes.

The company also confirmed that systems storing credentials used for blockchain node connections were accessed. However, investigators found no evidence that the attacker actually read those credentials.

Nevertheless, Chainstack is treating the credentials as potentially compromised as a precautionary security measure.

According to the company's statement, customer nodes, the management console, and API services were not modified.

Full payment card numbers and security codes were also not exposed because the company does not store that information.

The total number of affected customers has not been disclosed.

How Was the ARTEX AI Tool Used in the Attack?

Chainstack's technical investigation revealed that the attack originated from an internet-facing Grafana test server.

The server, located in the development environment, still used its default administrator credentials. It also lacked additional authentication protection.

The attacker exploited this access to reach a Model Context Protocol (MCP) tool server that did not require authentication.

The server was operating with extensive administrative privileges within the Kubernetes infrastructure.

Machine credentials obtained from the development environment were subsequently used to gain access to production systems.

Chainstack stated that it assessed with high confidence that ARTEX, an open-source tool designed to coordinate AI agents, was used during the attack.

However, the use of ARTEX does not conclusively establish the identity of the individual or group responsible for the intrusion.

The company also reported finding no evidence that a known software vulnerability had been exploited.

According to the investigation, the attack was made possible by a combination of weak security configurations and excessively broad access permissions.

Chainstack Urges Users to Change Their Passwords

Chainstack reported that it terminated the attacker's access on October 31 and completed its incident investigation on November 2.

The company contacted all customers by email, urging them to change their account passwords.

Customers who had reused the same password on other services were also advised to update those accounts.

Additional security recommendations included rotating node credentials and regenerating platform API keys.

Chainstack explained that node credentials could be rotated through the management console without interrupting services.

The company also warned customers to remain vigilant against phishing attempts.

The possibility that compromised information could be used in fraudulent support messages represents an additional concern following the attack.

Kriptofoni Analysis

The Chainstack incident demonstrates that blockchain infrastructure security extends far beyond smart contracts and cryptographic mechanisms.

Default passwords used in development environments, excessively broad permissions, and credentials shared with production systems can create serious security risks.

The ability of AI-powered attack tools to identify and exploit such weaknesses more rapidly makes access controls and credential management increasingly important for infrastructure providers.

Although Chainstack's announcement that it has contained the breach is a positive development, customers still need to complete the recommended security updates to protect their accounts and infrastructure.