Incident BriefingsChainstack account and node-credential incident

Chainstack account and node-credential incident

Chainstack reported an intrusion that reached development infrastructure on October 26, 2026, and parts of production on October 29.

Last modified

Summary

  • Environment: Development, production and blockchain-node credential systems
  • Operational impact: Account database accessed; node credentials treated as exposed
  • Financial impact: No incident cost disclosed
  • Record status: Developing record. Reviewed November 4, 2026; updated as evidence emerges.

What happened

Chainstack reported an intrusion that reached development infrastructure on October 26, 2026, and parts of production on October 29. [1]

Impact

An accessed database held organization and account-holder names, member email addresses and password hashes. Node credentials were treated as exposed despite no evidence they were read. [1]

Chainstack said customer services continued normally and nodes, the console and API were not modified. [1]

Timeline

  1. Development environment accessed

    Development environment accessed, according to the published account. Incident notice.

    [1]

  2. Production access begins

    Production access begins, according to the published account. Incident notice.

    [1]

  3. Intrusion detected and access cut

    Intrusion detected and access cut, according to the published account. Incident notice.

    [1]

  4. Investigation closed

    Investigation closed, according to the published account. Incident notice.

    [1]

  5. Briefing updated

    This briefing was last reviewed and updated on November 4, 2026.

Threat Group & Attack Vector

The company identified a third-party component as the access path, without naming it or establishing a specific vulnerability. [1]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

  • No specific MITRE ATT&CK technique is currently mapped for this case.

Response

Chainstack cut access on October 31 and closed its investigation on November 2. Customers were asked to change passwords, rotate node credentials and regenerate platform API keys. [1]