Chainstack, the blockchain node and RPC provider, says the attacker who reached its customer database got in through a test Grafana dashboard that was open to the internet with its default administrator password unchanged. From there the intruder found an internal AI tool server that required no login and ran with full control of a Kubernetes cluster. The company’s incident report, which it expanded with technical details and indicators of compromise this week, says the attacker used ARTEX, an open-source framework that runs teams of AI agents through an intrusion.
What was exposed and what customers need to do
According to Chainstack, the attacker accessed a database holding organization names, account holder names, the email addresses of organization members and password hashes. It does not store full card numbers or security codes, so those were not exposed. The attacker also had access to systems holding node credentials. Chainstack said it has no evidence those were read but is treating them as exposed.
The company is emailing customers and asking them to change passwords, including anywhere the same password was reused, rotate node credentials, regenerate platform API keys if they use the platform API, and watch for phishing. Node credential rotation is self-service in the console, and current endpoints keep working until a customer rotates, so there is no downtime. “Chainstack will never ask for passwords, tokens or keys,” the report says. Customer nodes, the console and the API were not modified, according to the company, and customer-facing services ran normally throughout.
Three days from a test dashboard to production
The timeline in Chainstack’s report runs from Oct. 26, when the attacker gained access to a development environment, to Oct. 29, when they reached parts of production. Chainstack detected the intrusion on Oct. 31 and cut the access paths that day, then closed the investigation on Nov. 2. It first published the report on Nov. 3.
The entry point had been sitting there since July. A test Grafana instance in a development cluster was reachable from the internet with no single sign-on or basic authentication in front of it. Once logged in as administrator, the attacker used Grafana’s data-source proxy, which forwards requests to whatever URL a data source points at, to reach dozens of internal services. One of them was an MCP tool server, the kind of service that exposes Kubernetes operations to AI agents. It required no authentication and its service account had cluster-admin rights.
The rest followed from credentials. The attacker hijacked an automation workflow to pull a machine identity that also worked in production, read production Kubernetes secrets, then read secrets in bulk from the production cloud secrets manager. Among them was the private key of a VPN peer on the database network. Two clients presenting the same peer key made the tunnel flap and broke a database replication pipeline. That failure is what started Chainstack’s investigation. Before access was cut, the attacker had queried a production database as an administrative user and, on one PostgreSQL instance, queried the view that holds database role password hashes.
Chainstack said it found no evidence that a software vulnerability was exploited. The attack chained default credentials, exposed admin functions, missing authentication, over-broad permissions and long-lived credentials.
Why the ARTEX detail matters
Chainstack said it assesses with high confidence that ARTEX was used, citing artx and artex naming markers on resources the attacker created, use of the chisel tunneling tool, and many attack paths running in parallel with rapid retries. Google’s threat intelligence group has described ARTEX as a multi-agent penetration testing platform that several threat actors have used since late August, and CrowdStrike has tied it to a campaign against more than 200 organizations.
Chainstack was careful about what that link means. The company said it attributes the tooling, not the actor, and that none of its indicators match those published for the groups CrowdStrike and Microsoft have named.
It is the second crypto infrastructure firm in two weeks to describe an AI-assisted intrusion. Chainalysis said on Oct. 30 that an external actor used “offensive agentic techniques” against its systems, and later found credentials for all its users had been exposed, as we reported in our story on the Chainalysis breach.
Who should pay attention
The Chainstack breach matters first to its own customers. Projects that call a Chainstack endpoint with an embedded credential should rotate it, since the provider cannot rule out that those credentials were read. Teams outside Chainstack can use the report too. It lists attacker IP addresses, file hashes and Kubernetes object names, and a set of checks that would have caught the activity earlier, including Grafana proxy requests to internal addresses, unauthenticated MCP servers and the same VPN key appearing from two endpoints.
Its remediation plan, parts of which are still in progress, puts an extra authentication layer such as single sign-on in front of admin tools, strips cluster-admin rights from AI tool servers and removes any path from development to production.
FAQ
Were Chainstack customer nodes affected?
Chainstack says customer nodes, the console and the API were not modified and services ran normally. Full card numbers and security codes were not stored, so they were not exposed.
What should Chainstack users do now?
Change passwords, rotate node credentials in the console, regenerate platform API keys if used, and ignore any message asking for passwords, tokens or keys.
Was an AI model hacking Chainstack on its own?
Chainstack says the attacker used ARTEX, a framework that directs AI agents through an intrusion. It has not identified who operated it.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
