Blockchain infrastructure provider Chainstack disclosed an AI-driven cyberattack that occurred between October 26 and 31, 2026, exposing customer account information including organization names, account holder names, member email addresses, and password hashes. The attacker gained entry through a Grafana instance with default administrator credentials and no single sign-on protection, then leveraged an unauthenticated MCP tool server to obtain cluster administrator privileges before reaching production databases. The investigation revealed the attacker used the open-source framework ARTEX, with no evidence of software vulnerability exploitation. While there is no indication that node credentials stored in accessible systems were read, Chainstack is requiring customers to rotate them as a precaution. Customer-facing services remained operational throughout the incident, and nodes, the console, and API were not modified. Chainstack has cut off the attacker's access paths and is urging customers to change passwords, regenerate platform API keys, rotate node credentials, and remain alert to phishing messages.