Chainstack Traces Customer Data Breach to Exposed Admin Tools

TL;DR: Chainstack’s expanded incident report focuses on access-control failures. Its recovery guidance makes completed credential rotation a priority.

Chainstack has added technical detail to the security incident it first disclosed on November 3. Its updated report, with a technical section dated November 10, describes an October intrusion built around configuration and access-control failures. The company says it found no evidence that a software vulnerability was exploited.

How the access controls failed

According to Chainstack, the attacker entered through a development Grafana instance with unchanged default administrator credentials. An unauthenticated tool server with broad Kubernetes permissions then formed part of the access path. Machine credentials also connected the development and production environments.

The operational lesson is about the reach of an account after the first login. A low-profile testing service can become consequential if it can contact sensitive systems or holds privileges that extend beyond its immediate job.

NewsBTC's coverage of the NEAR AI infrastructure incident explored a related boundary between an application and the services supporting it. The mechanisms differ, but both make the surrounding infrastructure relevant to a crypto platform's security.

What customers are being asked to address

The report identifies account names, organisation details, email addresses and password hashes as potentially exposed. It treats node credentials as exposed despite finding no evidence they were read, and asks customers to change passwords, rotate node credentials and regenerate platform API keys where used.

A password hash and a working access token create different problems. Hashes are representations of passwords, while an active token may directly authorise requests. Replacing a login password therefore cannot be assumed to invalidate every other credential associated with an application.

This is why incident guidance needs to identify the affected credential types clearly. A single instruction to change a password can leave developers uncertain about application endpoints, automated jobs and service integrations.

Credential rotation has a completion step

Chainstack's node-management documentation describes a staged rotation process. New credentials are generated while the existing ones remain active. Applications can then move to the replacements before the old credentials are deactivated.

The documentation says both sets continue working until that final step, with no automatic time limit. Completing the rotation permanently rejects requests using the previous credentials. It also says a node rotation does not change a multichain authentication token.

For an operator, the overlap reduces the risk of interrupting a working service while updating applications. The corresponding responsibility is to finish the migration. Generating a replacement alone leaves the previous means of access available.

A useful completion record would therefore track which applications have moved and when the old credentials were disabled. That is a practical control a team can verify after the initial emergency.

The underlying design problem is familiar

Grafana's security guidance warns that services on its local network may be reachable through its data-source proxy. It describes controls such as limiting permitted destinations and using firewall rules to restrict access to sensitive internal services.

Those precautions address what a tool can reach, as well as who can log into it. Authentication and network boundaries perform different jobs; permission limits provide another layer if either boundary fails.

NewsBTC's report on Chainalysis restoring screening services shows why operational recovery and data-exposure analysis can follow different timelines.

Chainstack's expanded account gives customers more detail to assess. The remaining test is whether access changes are completed and whether the revised controls can prevent one compromised service from reaching far beyond its intended role.

written by the News Desk and edited by Samuel Rae.