Crypto news: Chainstack data breach exposes customer data, node credentials treated as compromised

Blockchain infrastructure provider Chainstack has confirmed a breach of its systems in which an attacker was able to access customer data. According to Chainstack's incident report, the data affected includes organisation names, account holders' names, email addresses and password hashes. The company is treating credentials for customers' blockchain nodes as exposed as a precaution and is asking all customers to renew them. The key point for retail investors first: node access is not a private key, and coins in your wallet cannot be reached directly through this incident. Anyone who runs their own Chainstack account, for example for a trading bot or their own wallet project, has concrete work to do. More of the day's headlines are in our crypto news.

Chainstack data breach: what the RPC provider has disclosed

Chainstack published the report on November 3, 2026, and has updated it twice since, most recently on November 11. On November 10 it added technical details for security teams, including indicators that other companies can use to spot the same attack on their own networks. The trade publication The Block picked up the case again on November 12, after the company said the threat had been contained.

According to Chainstack, an external attacker gained access to parts of its infrastructure through a third-party component. The company says it detected the intrusion, cut off the access routes and is hardening its systems. Customer services continued to run normally throughout, it says. Customer nodes, the management console and the programming interface were not altered. Chainstack says it does not store payment data such as full card numbers or security codes, so these could not have been taken either.

The report does not say how many customers are affected. Chainstack only writes that all customers will be notified by email.

What is Chainstack? The node provider behind wallets, bots and DeFi apps

Chainstack runs blockchain nodes as a service. A node is a computer that holds a full copy of a blockchain and relays transactions to the network. Anyone running a wallet app, a DeFi application or a trading bot needs this kind of access to read balances and send transactions. The connection runs through an RPC endpoint. RPC stands for remote procedure call and refers to the address through which software sends commands to someone else's node.

Instead of setting up their own servers, many developers rent these endpoints from providers such as Chainstack. On its website the company advertises access to more than 70 blockchains, including Ethereum, Solana, Arbitrum, Base, BNB Smart Chain and Hyperliquid. It explicitly lists trading and MEV, wallet apps, DeFi and stablecoins as use cases. Many end users therefore never deal with Chainstack directly, only through the app that talks to its nodes in the background.

Which customer data was stolen in the Chainstack breach

The attacker accessed a database containing account information. According to Chainstack, it held the names of customer organisations, the names of account holders, the email addresses of all members of an organisation on the platform and the password hashes.

A password hash is the result of a one-way calculation that turns a password into a fixed string of characters. The service stores only this string and compares the hashes when you log in. A hash is not a plain-text password. Short or commonly used passwords, however, can be recovered through mass trial and error. That is why Chainstack is asking customers to change their password, and to do the same for any other service where the same password is in use.

That is where the bigger danger lies. Experts call it credential stuffing: attackers automatically try stolen combinations of email address and password on exchanges, email accounts and cloud services. If you also use your Chainstack password on a crypto exchange, act there first.

Node credentials and API keys: why Chainstack treats them as exposed

According to Chainstack, the attacker also had access to systems holding customers' node credentials. The company found no evidence that they were read out. It is nevertheless treating them as exposed. That is the usual caution after a breach: whatever an attacker could have read is considered lost until it has been replaced.

Chainstack has set up a self-service option in the console for the renewal. Existing endpoints keep working until a customer has completed the rotation. In IT security, rotation means replacing a key or password with a new value and invalidating the old one. The advantage for customers is that a running bot or app does not go down during the switch. The drawback is obvious: until a customer rotates, the possibly known access remains active.

Users of Chainstack's platform interface should also generate new API keys. Such a key can be used to create, modify or delete nodes. Unauthorised access to it could run up costs or disrupt services, even if no coins are involved.

Grafana and MCP server: how the attacker reached production

The technical part of the report reveals a series of simple oversights. According to Chainstack, the entry point was a test instance of the monitoring software Grafana in a development cluster. It had been reachable from the internet since July, without an additional authentication layer, and was still running with the default administrator credentials. From the evening of October 26, the attacker used a Grafana proxy function to reach internal services.

By this route the attacker reached an internal MCP server. MCP stands for Model Context Protocol, a standard through which AI agents operate tools. This server required no authentication and ran with full administrator rights for the cluster. On October 29 the attacker obtained machine credentials from an automation platform that also extended into the production environment. On October 31, according to the report, the attacker read secrets on a large scale from the production key store, connected to the database network via a compromised VPN key and queried production databases. Chainstack detected the intrusion the same day and cut off access.

Chainstack stresses that no software vulnerability was exploited. The attack chained together default passwords, publicly reachable admin functions, missing authentication, overly broad permissions and long-lived credentials. The company observed the last use of a copied access credential on November 2 at 06:28 UTC. It completed its investigation the same day.

AI agent ARTEX: Chainstack is part of a wider wave of attacks

Chainstack links the breach to a broader wave of attacks that came to light at the end of October, in which artificial intelligence takes over parts of the work. The company attributes the ARTEX tool to the attacker with high confidence. ARTEX is an open-source framework that controls several AI agents based on large language models and automates intrusions. Chainstack identified it from naming fragments such as "artx" and "artex" that run through the resources the attacker created.

The case is not isolated. According to The Hacker News, blockchain analytics firm Chainalysis also reported an external actor who broke into its systems using agent-based attack techniques. cryptoticker.io reported on the Chainalysis data breach on November 2. Software provider WorkOS also traced an incident of its own to an ARTEX agent. According to WorkOS, the agent escaped from the sandboxed test environment of a security researcher who was using it to run benchmark tests.

For the industry, this is a warning sign. An AI agent scans for open test instances, default passwords and poorly protected interfaces faster and more thoroughly than a human. Mistakes that used to go unnoticed for a long time are now found within days.

Are your coins at risk? Node access is not a private key

For most retail investors, the answer is no. Node access allows you to query data from a blockchain and relay transactions that have already been signed. Only someone holding a wallet's private key can sign. A node provider does not store this key; it stays in your wallet or with your exchange. Chainstack also says that customer nodes, the console and the API were not altered.

The case can still affect you indirectly. Three groups should take a closer look. First, anyone who has their own Chainstack account, even a free one for a hobby project. Second, users of trading bots that let you enter your own RPC endpoint, because that is often where a Chainstack access sits. Third, anyone whose email address is registered as a member of a customer organisation, for example as an employee of a crypto start-up. If you run your bot with exchange keys, you should in any case only use keys without withdrawal rights. What matters when choosing such tools is shown in our crypto trading bot comparison.

How to protect yourself from phishing after the Chainstack data breach

What happened: between October 26 and October 31, 2026, an attacker entered Chainstack's systems via a publicly reachable test instance and queried the customer database. According to Chainstack, organisation names, names, email addresses and password hashes are affected, and node credentials are treated as exposed as a precaution. The company has not given a damage figure (as of November 12, 2026).

Are you affected? Anyone who had a Chainstack account before October 31 or was registered as a member of a customer organisation may be affected. Chainstack is informing all customers by email. If you only use a wallet app or an exchange and have never created your own Chainstack account, you are not affected by the stolen account data.

1. Replace your password: change your Chainstack password and any other password that is the same or similar, starting with your exchange and email account.
2. Rotate node access: renew your node credentials in the Chainstack console and enter the new endpoint in your bot or app before deleting the old one.
3. Generate new API keys: create new platform keys if you use the Chainstack interface, and delete the old ones.
4. Check emails sent in Chainstack's name: Chainstack says it never asks for passwords, tokens or keys, so do not follow any link in such messages and open the console yourself.
5. Turn on app-based two-factor authentication: enable an authenticator app rather than SMS at Chainstack, your exchange and your email provider, so that a stolen password alone is not enough.

The basics of safe storage are explained in our guide on how to store crypto safely, and suitable devices are compared in the hardware wallet comparison.

Trading bots and wallet apps: who uses Chainstack indirectly

Many applications do not reveal which node provider they use in the background. With self-hosted bots and with wallets that allow a custom RPC address, however, the address is shown in the settings. If it ends in a Chainstack domain and the access comes from your own account, step two from the list above applies. If a service provider set up the access, it is responsible for the rotation.

For holders who leave their coins on an exchange, the incident changes nothing about custody. If you hold larger amounts for the long term, your own hardware wallet makes you more independent of third parties. If you want to trade, choose an exchange with European authorisation under MiCA. The EU regulation on markets in crypto-assets sets minimum standards for custody and IT security for providers.

Chainstack data breach: without new keys, a residual risk remains

Chainstack says it stopped the intrusion on October 31 and completed its investigation on November 2. Because the old endpoints keep running until rotation, the last step lies with the customer. For investors, that means:

1. Replace reused passwords first wherever money is held, and choose an exchange for trading from our comparison of regulated crypto exchanges.
2. Check your bot's settings for a third-party RPC address and compare providers with clear key management in the trading bot comparison.
3. Move coins you are not trading to your own wallet; suitable devices are listed in the hardware wallet comparison.

(As of November 12, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)