HighBreach · 2026-11-04

Chainstack breached: customer data and password hashes accessed, node credentials treated as exposed

What happened

Blockchain infrastructure provider Chainstack says an outside attacker got into part of its infrastructure through a third-party component. The attacker reached a development environment on October 26, then escalated into parts of production. Chainstack detected the intrusion and cut off access on October 31. It's assessed to be part of a large AI-powered attack campaign that surfaced last week.

Who's affected

Chainstack customers. The attacker accessed a database with organization names, account holder names, member email addresses and password hashes. The attacker also had access to systems holding node credentials; Chainstack says there's no evidence they were read but is treating them as exposed.

✅ Fix / patch

Rotate your Chainstack node credentials and regenerate your platform API keys now.
Change your Chainstack password, and any other account where you reused it, since password hashes were taken.
Watch for phishing that uses your name, org name or Chainstack account details.

🔎 Quick hunt check

For teams using Chainstack: review RPC and node usage logs from October 26 onward for requests from unfamiliar IPs or unusual call volumes using your old credentials, and confirm old API keys are revoked after rotation.

MITRE ATT&CK: T1195.002, T1078, T1552.001, T1110.002

IOCs

No IOCs (IPs, domains or hashes) published by the sources yet.

Hunt queries

Starting points built only from published indicators. Field names vary; tune before use.

index=proxy (dest="*.chainstacklabs.com" OR dest="*.p2pify.com" OR dest="*.core.chainstack.com" OR url="*chainstack*")
| stats count dc(src_ip) as sources values(src_ip) as src by dest, http_user_agent
| sort - count

// Find every app/host still calling Chainstack endpoints so you know what to re-key after rotation
DeviceNetworkEvents
| where RemoteUrl has_any ("chainstack","p2pify.com","chainstacklabs.com")
| summarize Calls=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by DeviceName, InitiatingProcessFileName, RemoteUrl