Chainstack Was Inside Its Dev Environment on October 26 and Part of Production by October 29. It Is Treating Node Credentials as Exposed. It Links the Breach to the ARTEX Campaign.
If you use Chainstack, rotate your node credentials and regenerate your platform API keys now, and change your Chainstack password everywhere you reused it. Chainstack says an attacker came in through a third-party component, reached its development environment on October 26 and parts of production on October 29, and was cut off on October 31. It says it has no evidence the node credentials were read, and it is treating them as exposed anyway.
What Chainstack says
The dates and data below are from Chainstack's own notice, dated November 3, which we read. The Hacker News gives the same development-environment date and does not date the move into production.
An external attacker gained access to part of Chainstack's infrastructure through a third-party component, which the page does not name. Chainstack detected the intrusion on October 31 and cut the attacker's access paths the same day. It says it closed the investigation on November 2 and is hardening its systems.
Reached: a customer account database holding organization names, account holder names, the email addresses of organization members, and password hashes. Also systems holding node credentials. Chainstack says it has "no evidence they were read," and that it is treating them as exposed.
Chainstack says was not affected: payment details, because it does not store full card numbers or security codes. Customer nodes, the console and the API were reportedly not modified, and customer-facing services kept running.
What Chainstack asks customers to do
Change passwords, including on other services where the same password was used.
Rotate node credentials. Rotation is self-service in the console. Existing endpoints keep working until the rotation is complete, so there is no downtime.
Regenerate platform API keys if you use the platform API.
Watch for phishing. Chainstack says it will never ask for passwords, tokens or keys.
The practical order for a blockchain developer is the credentials first, because those are the ones that can be used to reach a node, and the passwords second.
The ARTEX link, and how much weight it carries
Chainstack's page says the incident may be part of a broader AI-powered campaign, and links to a late-October Hacker News article. The Hacker News's account says the incident is assessed to be part of that campaign, which it links to a China-linked cluster using an AI attack framework called ARTEX. It describes this as an assessment of overlap and not a confirmed attribution. We would hold it the same way. Chainstack did not disclose attack specifics, and its own page says the link "does not change" its responsibility.
We covered ARTEX on October 31, when CrowdStrike reported one operator using it against more than 200 organizations, and said every way in was old: https://www.dugganusa.com/post/artex-off-the-rack-vapor-panda-crowdstrike. The Hacker News's piece lists related incidents that it connects to the same framework: WorkOS, discovered October 30, which says it was limited to go-to-market systems; and Chainalysis, which took its Reactor and Data Solutions products offline as of November 2 after detecting an external actor using offensive agentic techniques. The 200-organization figure in that sidebar is CrowdStrike's number, per the headline, and we have not verified it here.
What is not known
How many customers are affected. Which third-party component was the way in. Which hashing algorithm protected the passwords, and whether the hashes were salted or cracked. Which production systems were reached beyond "some parts." What kinds of node credentials were stored there. Whether any credential was used. There are no indicators of compromise on Chainstack's page or in the article.
What we hold
Nothing to ingest: no IPs, domains or hashes were published, and we are not going to guess a campaign signature for an attack described this thinly.
Limits
We read Chainstack's notice and The Hacker News's report. We did not read WorkOS's or Chainalysis's notices, and did not open the ARTEX article. The campaign link is Chainstack's and The Hacker News's assessment and not ours.
Five percent of this is wrong somewhere. It always is.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments