Chainstack Requires Credential Rotation After Customer Data Breach

By Daniel Okafor

Chainstack said it contained the data breach and closed the incident on Nov. 2 after an attacker reached a customer database and systems holding blockchain-node credentials, prompting customers to rotate credentials and change reused passwords. The infrastructure provider’s incident report, dated Nov. 3 and updated Nov. 11, said customer nodes, its console and API were not modified.

Organization names, account holders’ names, members’ email addresses and password hashes may have been exposed in the customer database, Chainstack said. The attacker also reached systems holding node credentials. Chainstack found no evidence that those credentials were read but treats them as exposed. Customer-facing services operated normally throughout the incident, it said.

“We found no evidence that a software vulnerability was exploited,” Chainstack said. The company instead attributed the intrusion to a chain of default credentials, missing authentication and excessive permissions.

The incident report separates service disruption from data and credential exposure. Chainstack reported no changes to customer nodes, its console or API, but said copied node credentials create a risk of unauthorized node use. The company also warned that changing an account password does not replace the credentials applications use to connect to hosted blockchain nodes.

Chainstack dated initial access to its development environment to Oct. 26 and access to parts of production to Oct. 29. It said it cut the access paths on Oct. 31, but some copied credentials for external services continued working until they were rotated. Their last observed use came on Nov. 2, when Chainstack closed the incident.

How did the attacker gain access?

According to Chainstack’s technical account, the attacker entered through an internet-facing Grafana test instance that still had unchanged default administrator credentials. From there, the attacker reached an internal AI tool server with no authentication requirement and cluster-administrator permissions. Credentials obtained in development also allowed access to production.

Chainstack said the attacker used ARTEX, a framework that coordinates language-model agents to automate intrusions. Its assessment cited naming markers in attacker-created resources and parallel attack paths. The company stressed that identifying the tooling did not identify the attacker.

What must customers rotate?

Customers must rotate each active node-credential set separately. A node rotation does not change a multichain authentication token, which can authorize access across several nodes. Replacing that token requires a separate workflow:

• Create a new multichain endpoint.
• Attach the same nodes.
• Switch applications to its token.
• Delete the old endpoint.

Chainstack’s guide says customers can generate replacement credentials without downtime, update their applications and then deactivate the old credentials. Both sets remain valid until that final step, and the company has set no time limit. Applications still using old credentials will have their requests rejected after deactivation.

The company also asked customers to change any Chainstack password they used elsewhere, regenerate platform API keys if they use the platform API, and watch for phishing. “Chainstack will never ask for passwords, tokens or keys,” the company said.

For customers yet to complete the process, the remaining exposure continues until they rotate each credential set and deactivate the old access paths.