Chainstack says an attacker using an AI agent framework broke in through a test dashboard left on its default login and exposed customer password hashes

A test dashboard left on its default login opened the door. Chainstack, which runs blockchain nodes and APIs for developers, says an attacker was inside its systems for nearly five days before being detected last month. The intruder also reached customer account data, according to the company's incident report, which it updated on November 10 and 11. The Block reported the findings on Thursday.

The entry point was a Grafana monitoring instance in a development cluster that could be reached from the internet, had no single sign-on in front of it and still used its default administrator credentials. From there the attacker reached an internal tool server with broad permissions and stole machine credentials that also worked in production. Chainstack says it found no evidence that a software vulnerability was exploited. The attacker got in on October 26, reached production on October 29 and was detected on October 31, when a compromised VPN key disrupted database replication. Some copied credentials kept working until they were rotated; the last observed use was on November 2.

Exposed data include organization names, account holder names, members' email addresses and password hashes. Chainstack found no sign that node credentials were read but is treating them as exposed and asks customers to rotate them, change passwords and regenerate platform API keys. It says: "Customer nodes, the console, and the API were not modified." Chainstack has not said how many customers were affected and is notifying all customers by email. It assesses with high confidence that the attacker used ARTEX, a tool that public reporting has tied to several unrelated groups, so it does not name the attacker.