In a report published on November 12, 2026, BlockBeats relayed Chainstack’s updated account of an earlier security incident. According to the blockchain infrastructure provider, the attacker entered its development environment on October 26, reached parts of its production environment on October 29, and accessed its customer account database on October 31.
Chainstack said information that may have been exposed includes organization and account-holder names, member email addresses, and password hashes. The attacker also accessed a system holding node credentials. Chainstack said it found no evidence that those credentials were read, but asked customers to rotate them.
According to Chainstack, the initial entry point was a Grafana test instance that retained default administrator credentials. The attacker then expanded access using an unauthenticated MCP tool server and stolen machine credentials. Its investigation found that the attacker used the ARTEX framework, but found no evidence that a software vulnerability was exploited. Chainstack said customer nodes, its console, and its API were not modified.
Original report: BlockBeats · Published November 12, 2026, at 13:12 (UTC+8).