Chainstack, a provider of blockchain infrastructure, has reported a significant breach of its production systems. The cyber attack was part of a large-scale campaign leveraging artificial intelligence to exploit vulnerabilities. Unauthorized access was gained through a third-party component, allowing attackers to infiltrate both development and production environments. The breach, detected on October 31, 2026, involved unauthorized access to a database containing customer account information, such as organization names, account holder names, email addresses, and password hashes. Although there is no evidence of node credentials being read, Chainstack has advised customers to treat them as exposed.

In response to the intrusion, Chainstack has taken measures to cut off the attacker's access and is reinforcing its security systems. Customers are urged to rotate their node credentials, regenerate platform API keys, update passwords, and be vigilant against phishing attacks. The breach is believed to have connections with a China-linked group utilizing ARTEX, a framework for conducting advanced cyber operations.

This incident is not isolated. Other organizations, including API platform WorkOS and Chainalysis, have also faced similar AI-driven attacks. WorkOS reported a security incident affecting its GTM systems, while Chainalysis took proactive measures by temporarily taking some of its products offline after detecting unauthorized access. AI agents are increasingly being used to craft targeted attack strategies, highlighting the urgent need for improved monitoring and swift remediation efforts to protect against such sophisticated threats.