Short answer
Chainstack, a blockchain node provider, disclosed on 3 November 2026 that an attacker entered through a third-party component, reached a development environment on 26 October and some production systems on 29 October. It detected the intrusion on 31 October and says customer nodes, console and API were not modified.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Chainstack |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Blockchain infrastructure |
| Country | Not stated in the notice |
| Detected | 2026-10-31 |
| Disclosed | 2026-11-03 |
| People or records affected | Customer account database; Chainstack has not published a count |
What data was exposed
- Organization names and account holder names
- Email addresses of organization members
- Password hashes
- Node credentials, which the attacker could reach; Chainstack has no evidence they were read but treats them as exposed
What happened
Chainstack, a provider of blockchain node infrastructure, published a security incident notice on 3 November 2026. It says an external attacker gained unauthorized access to part of its infrastructure through a third-party component, which it has not named.
According to the notice, the attacker reached a development environment on 26 October, gained access to some production systems on 29 October, and was detected on 31 October. Chainstack cut the access paths the same day and says it finalized its investigation and closed the incident on 2 November.
What was exposed
The notice lists organization names, account holder names, email addresses of an organization’s Chainstack members, and password hashes. The attacker also had access to systems holding node credentials. Chainstack says it has no evidence they were read but is treating them as exposed.
Chainstack says customer nodes, the console and the API were not modified, and customer-facing services kept running. It says payment details were not exposed because it does not store full card numbers or security codes.
Possible link to a wider campaign
The Hacker News reports the incident may be tied to a large AI-driven campaign called ARTEX, which it associates with a China-linked group. Chainstack has not confirmed that link, so treat it as a press report, not a finding. The same article lists other recent incidents, including the Chainalysis breach and the WorkOS sales app breach.
What Chainstack tells customers
Chainstack asks customers to change passwords, including on any service where they reused the same one, rotate node credentials, regenerate platform API keys if they use the platform API, and watch for phishing. Self-service credential rotation is available in the console, and current endpoints keep working until it is finished, so there is no downtime. The company says it will never ask for passwords, tokens or keys, and that its incident page is the single source of truth.
Scam risks for crypto developers
People who build on node providers hold keys that can move money. Attackers who learn a company’s name and team emails can write convincing messages. Our data breach checklist covers the first steps. For fake wallet and airdrop lures, see the crypto wallet drainer guide, and the phishing messages guide shows how to check a suspicious email.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails posing as Chainstack that ask for your password, token or API key, which the company says it never requests.
- Credential stuffing that tries the same email and password on exchanges, wallets and cloud accounts.
- Targeted messages at crypto developers that use the exposed organization and member names.
What to do if you are affected
- 01Change your Chainstack password, and any other account where you reused it.
- 02Rotate node credentials in the console. Chainstack says current endpoints keep working until you finish.
- 03Regenerate platform API keys if you use the platform API.
- 04Treat any message asking for a password, token or key as suspicious, since Chainstack says it never asks for them.
- 05Review access logs on services that used Chainstack node credentials for activity you do not recognize.
Frequently asked questions
How did the attacker get in?
Chainstack says through a third-party component. It has not named the component in the notice.
What is the timeline?
Chainstack says the attacker reached a development environment on 26 October 2026, some production systems on 29 October, and was detected and cut off on 31 October. The investigation was closed on 2 November.
Were payment details taken?
Chainstack says payment details were not exposed because it does not store full card numbers or security codes.
Is this linked to the Chainalysis incident?
The Hacker News reports it may be linked to a larger AI-driven campaign it associates with a China-linked group. Chainstack has not confirmed that link.
Did customer services go down?
No. Chainstack says customer nodes, the console and the API were not modified and customer-facing services kept running.
Sources
- Chainstack security incident (November 2026), Chainstack, 2026-11-03
- Chainstack Reports Production Systems Breach Exposing Customer Data and Password Hashes, The Hacker News, 2026-11-03
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.