Chainstack Production Breach Exposes Customer Hashes and Node Credentials via ARTEX Third-Party Vector

The intrusion began in a development environment before lateral movement into production systems. Chainstack isolated the paths on October 31 and reset customer node credentials plus API keys. No evidence confirms credential exfiltration, yet the company treated all as exposed. This matches the ARTEX pattern seen at WorkOS GTM systems and Chainalysis Reactor tools, where AI agents automated reconnaissance and privilege escalation. The technical trail points to exploitation of unpatched third-party components rather than direct zero-days in Chainstack code. WorkOS reported the same agent framework accessing CRM and call summaries without touching core platform data. DIVD's September breach via two Zammad CVEs (2026-102489 and 2026-102490) shows the campaign's focus on ticketing and support infrastructure to gain initial footholds before pivoting to higher-value targets. Official statements describe the actor as a China-linked cluster, yet no independent technical attribution such as malware samples or C2 infrastructure overlaps has been published. The speed of the attacks aligns with autonomous AI tooling that chains credential stuffing, API abuse, and living-off-the-land techniques across multiple victims in under a week. Customers must rotate node keys and monitor for phishing that leverages the exposed hashes. The next observable marker will be whether additional blockchain or API providers disclose similar third-party component compromises within the next 14 days.