Chainstack Hit by AI-Powered Attack Campaign, Exposing Customer Data

Blockchain infrastructure provider Chainstack has reported a significant cyberattack that compromised its production systems, leading to the exposure of sensitive customer data. The breach, which occurred between October 26 and October 31, 2026, was facilitated by an external attacker gaining unauthorized access through a third-party component.

Chainstack's investigation revealed that the attacker accessed a development environment before escalating their privileges to infiltrate parts of the production environment. The company detected the intrusion and immediately cut off the attacker's access paths, initiating system hardening measures. Despite these swift actions, the compromised data includes customer account information such as organization names, account holder names, email addresses, and crucially, password hashes. Additionally, systems holding node credentials were accessed, though Chainstack has no evidence they were read.

In response to the incident, Chainstack has advised its customers to rotate node credentials, regenerate platform API keys, and update passwords across all services, especially where reuse is common. Customers are also urged to remain vigilant against potential phishing attempts. The company emphasized that while they have no evidence of credential misuse, they are treating all accessed data as potentially compromised.

This incident is believed to be part of a broader, sophisticated attack campaign leveraging artificial intelligence (AI) and an "agentic" framework known as ARTEX. This campaign has previously been linked to attacks against other high-value firms, including API platform WorkOS and blockchain analysis firm Chainalysis.

WorkOS confirmed a separate security incident discovered on October 30, 2026, which also involved the ARTEX framework. While WorkOS's incident was limited to its Go-to-Market (GTM) systems and did not affect production systems or customer data, the accessed information included business contact details, account and relationship information, customer communications, and operational metadata.

Similarly, Chainalysis reported an "external actor using offensive agentic techniques" to gain access to its systems and internal tools, leading them to take their Reactor and Data Solutions products offline. The growing use of AI agents in cyberattacks allows for the rapid development of tailored attack strategies and automation of intrusion phases, increasing the speed and scale of exploits against vulnerabilities like exposed applications and stolen credentials.

The ARTEX campaign has also been linked to a breach at the Dutch Institute for Vulnerability Disclosure (DIVD) in September 2026, where two zero-day flaws in the Zammad ticketing system were exploited to escalate privileges and exfiltrate data. The increasing sophistication and automation of these AI-driven attacks underscore the evolving threat landscape and the critical need for robust security monitoring and timely remediation.