Chainstack Discloses AI-Assisted Breach That Exposed Customer Data

Blockchain infrastructure provider Chainstack has disclosed a six-day breach that exposed customer account data, with intruders moving from a development environment into production systems between Oct. 26 and Oct. 31. The company confirmed the attack was AI-driven and said customer-facing services stayed operational throughout.

In a post-incident disclosure, Chainstack said the intruders entered through a Grafana instance that still ran unchanged default administrator credentials and had no single sign-on protection. From there the attack escalated quickly across the company's internal tooling.

The chain of compromise, as reconstructed by Chainstack:

• Initial access via the unprotected Grafana instance in the development environment
• Use of an unauthenticated MCP (Model Context Protocol) tool server to obtain cluster administrator access
• Credential theft through an automation platform
• Lateral movement into production, where the attackers read a customer database

Exposed information included organization names, account-holder names, member email addresses and password hashes. The attackers also gained access to a system storing node credentials. Chainstack said it found no evidence those node credentials were actually read, but it is not taking chances.

What must customers do now?

Chainstack has asked customers to reset passwords, rotate all infrastructure credentials, regenerate platform API keys and stay alert for phishing attempts that could leverage the exposed email addresses. The password hashes are in attacker hands, so credential rotation is the practical mitigation rather than an optional precaution.

The company reported that customer nodes, its console and its APIs were not modified during the incident, and customer-facing services remained available. Chainstack said it has cut off the attackers' access and found no evidence that the intruders exploited a software vulnerability. Instead, the failure was operational: default credentials on an internet-facing admin tool and an unauthenticated internal MCP server.

Why does the MCP detail matter?

The mention of an MCP tool server places this incident in a growing category of security failures around AI tooling. MCP servers increasingly connect language models and automation agents to internal infrastructure, and an unauthenticated one effectively handed the attackers a privileged bridge into cluster administration. Chainstack also identified use of the open-source ARTEX framework in the intrusion.

For a node-hosting and RPC provider, the stakes are structural. Customers trust Chainstack with the credentials that control blockchain infrastructure, and a breach that reaches a credential store — even one with no confirmed reads — undermines that trust regardless of whether customer nodes were touched. The company's decision to disclose the access path in detail, including the default-credential failure, is unusual frankness for an infrastructure vendor.

The incident also serves as a concrete example of how AI-era tooling expands the attack surface: the attackers chained a neglected admin console, an agent-connected tool server and an automation platform into full production access without exploiting a single software bug.

Customers who have not yet rotated credentials should treat it as immediate, since exposed password hashes and email addresses give attackers a working starting point for follow-on phishing and credential-stuffing campaigns in the weeks ahead.