Chainstack says an attacker reached production through a third-party component and took password hashes

Blockchain infrastructure provider Chainstack said on November 3 that an attacker entered a development environment through a third-party component on October 26, reached parts of its production environment on October 29, and was detected and cut off on October 31. The attacker accessed a database holding organization names, account holder names, members' email addresses and password hashes. It also had access to systems holding node credentials; Chainstack has no evidence they were read but is treating them as exposed. Customer nodes, the console and the API were not modified, and full payment card details are not stored. Chainstack says the incident was part of the AI-powered attack campaign reported in late October. It asks customers to change passwords, including reused ones, rotate node credentials, which can now be rotated without downtime, and regenerate platform API keys.

Why it matters

Five days passed between the development foothold and detection, and the attacker crossed from development into production in that time. A development environment that can reach production data and credentials is the usual gap, and a third-party component as the entry point puts the supply chain in scope as well. Leaked password hashes become a cracking job, and password reuse turns that into account takeover elsewhere.

Rotate node credentials even without evidence they were read: the safe assumption for any secret an attacker could reach is that it was copied. Keep development and production identities separate, and alert on the first use of a production credential from a development host. More incidents of this shape are in our breach incident database, and the Identity Breach Report 2026 sorts them by how attackers got in.

Source: Chainstack