Chainstack reports customer account database access; rotate passwords and node credentials

Chainstack’s November 3 report says an attacker entered through an unnamed third-party component and accessed a customer account database. Organization names, account holder names, organization-member emails and password hashes may have been exposed. The company also treats node credentials as exposed because their hosting systems were accessible, although it found no evidence the credentials were read. Notifying all customers does not establish that every customer’s records were copied. No victim count or confirmed wallet loss is provided.

The vendor says customer nodes, the console and the API were not modified, and customer-facing services kept operating. It says full payment card numbers and security codes were not exposed because it does not store them. These are vendor findings, not an independent forensic verification. The report links the incident to a broader AI-powered campaign but does not name the component, actor or an exploit identifier; a connection to another named incident is unverified.

L4 reflects a confirmed intrusion into production infrastructure and access to customer account data, not a proven mass-victim count. There is no customer software patch. Passwords, node credentials and platform API keys are separate remediation tasks. Generating new node credentials alone leaves the old ones active until rotation is completed.