Blockchain infrastructure provider Chainstack has confirmed it suffered a production system breach, resulting in the exposure of customer data and password hashes. The incident was enabled via a compromised third-party component on October 26, 2026, but access into production systems wasn’t observed until later in the attack. Chainstack detected and contained the intrusion by October 31, cutting off the attacker’s access that same day.
What Was Accessed and What’s At Risk
The attacker accessed Chainstack’s development environment first, then escalated privileges to obtain access to portions of the production environment. Among the compromised assets are databases holding customer account details such as organization names, account holder names, email addresses, and password hashes. Additionally, systems storing node credentials were accessed—though Chainstack says there’s no proof these credentials were read, they’re being treated as exposed.
To address this exposure, Chainstack is urging customers to rotate node credentials, regenerate API keys, update reused passwords across services, and be alert to phishing attempts. These steps are precautionary, given the uncertainty about the attacker’s full reach.
AI-Driven Attack Campaigns & Related Incidents
Chainstack has connected this breach to a broader AI-powered threat campaign known as ARTEX, believed to be linked to China. ARTEX employs autonomous agent frameworks to execute tailored intrusion strategies. One similar incident involved WorkOS, which was breached via the same class of AI agent. WorkOS confirmed its GTM (go-to-market) systems were impacted, but its production systems and customer data remained untouched.
The trend isn’t isolated. Chainalysis has disclosed an attack using agentic techniques that impacted its system tools, prompting temporary shutdowns of its Reactor and Data Solutions products to investigate. Elsewhere, the Dutch Institute for Vulnerability Disclosure was breached in late September due to zero-day vulnerabilities in the open-source Zammad ticketing system, also attributed to ARTEX.
This style of attack—using AI agents—boosts the speed and sophistication of intrusions, especially when exploiting exposed applications or stolen credentials. Security experts warn that detecting suspicious behavior in real time, remediating vulnerabilities faster, and monitoring systems holistically are more essential than ever.
What this means: The Chainstack breach underscores a shifting paradigm in cybersecurity: attackers leveraging AI agents are becoming a growing threat. That means supply chains, credential hygiene, and third-party component security are increasingly critical. Organizations must strengthen their detection and response strategies for AI-driven threats—and fast.
