Blockchain infrastructure provider Chainstack disclosed on November 3 that an attacker accessed parts of its production environment and a database containing customer account information. The company is asking customers to change passwords, rotate node credentials and regenerate platform API keys.
The disclosure, also reported by The Hacker News, identifies a third-party component as the entry point. Chainstack said its findings indicate the incident formed part of a broader campaign of AI-powered attacks reported in late October. It did not name the component or detail the vulnerability exploited.
Access reached production on October 29
Chainstack’s published timeline dates the initial access to a development environment to October 26. The attacker reached some production systems on October 29. The company detected the intrusion on October 31 and says it cut the attacker’s access that day.
Chainstack said it completed its investigation and closed the incident on November 2. Its customer services continued operating normally throughout the intrusion, and the company said customer nodes, its console and its API were not modified.
Chainstack customer records and credentials
The accessed database contained customer account information. Potentially exposed fields include organization names, account holder names, member email addresses and password hashes.
The attacker also had access to systems holding node credentials. Chainstack said it had found no evidence those credentials were read, but is treating them as exposed and requesting rotation. Its disclosure does not state how many customers or organizations were affected.
Chainstack said payment method details, including full card numbers and security codes, were not exposed because it does not store them.
Password changes and key rotation
Customers are being notified by email. Chainstack asks them to change their passwords, including passwords reused on other services, and replace their node credentials. Customers using the platform API are also asked to regenerate their API keys.
The company said credential rotation is available through its console. Existing endpoints remain operational until customers complete the process, allowing credentials to be replaced without downtime.
Chainstack also warned customers to watch for phishing messages and said it would never request passwords, tokens or keys. It designated the incident page as the location for subsequent updates.
WorkOS and Chainalysis disclose incidents
Separately, WorkOS said it detected unauthorized access on October 30 to an internal application used by its sales team. Its investigation identified an AI-assisted offensive security framework used to automate reconnaissance and exploitation attempts.
WorkOS said its analysis indicated the incident affected CRM and customer support data. The information included business contact details, customer account histories, excerpts from customer communications and operational metadata. It reported no evidence that application data or production services were accessed or impacted.
WorkOS disabled external access to the application and retained an independent incident response firm. Its investigation remains ongoing, with affected customers to receive updates directly.
Chainalysis said in a November 2 update that it had taken Reactor and Data Solutions offline while conducting additional security assessments. The company had previously disclosed unauthorized access to systems and internal tools involving offensive agentic techniques.
Chainalysis said its compliance transaction monitoring products would continue operating while investigators reviewed the incident. It said those systems were being monitored for unusual activity.
In its October 30 disclosure, Chainalysis said investigators had found no evidence of unauthorized access to investigation content, authentication credentials or session tokens. It also said the incident was unrelated to the recent theft at Binance.