Chainstack: password hashes exposed, rotate the node keys

Chainstack told customers on Tuesday, November 3, 2026, that an outsider had reached part of its infrastructure. The blockchain node provider says the intruder came in through a third-party component, landed in a development environment on October 26, and from there reached portions of production. Detection and the cutoff both landed on October 31.

The customer database the attacker could read holds organization names, account-holder names, the email addresses of members on those organizations, and password hashes. The intruder also had a path to systems that store node credentials. Chainstack says it has found no evidence those credentials were opened. It is treating them as exposed and asking every customer to rotate them.

Hashes, keys, and the mailbox that follows

A password hash leaves with the record. The password behind it has to change, on Chainstack and on any other service where that password was reused. A node credential is the secret a project uses to talk to infrastructure the company runs. A platform API key is a second credential on the same account. Chainstack wants all three replaced: node credentials rotated, platform API keys regenerated, and passwords reset.

Names and work emails left with the hashes. That is enough raw material for a follow-on message dressed up as a key rotation, a billing change, or a node migration. Treat an unexpected Chainstack request as a ticket you open yourself, and start the real rotation from the dashboard you already use.

Reporting on the disclosure places it in the same season as a China-linked campaign built around the ARTEX agent framework. Chainstack’s notice stays with the third-party foothold, the October dates, and the data classes above. Customers can finish the rotation on those facts.

What to rotate today

Rotate node credentials for every project, including projects that have been quiet this month. Regenerate platform API keys and retire the previous values. Set a new account password, and change it anywhere else that password was reused. Brief the people who hold those keys, in the channel you already use for vendor fraud, that a familiar name in the from-line is one of the fields that left.

File the November 3 notice with the incident record. If your organization runs production traffic through Chainstack, treat your tenant’s names, emails, and password hashes as part of the accessed set. The company has asked customers to act as if the node material was exposed. Replace those credentials on that basis.

This briefing relies on public reporting by The Hacker News and on Chainstack’s disclosure.