According to CoinMeta, blockchain infrastructure provider Chainstack disclosed that it suffered a cyberattack driven by AI from October 26 to 31, 2026. The attackers entered the development environment through an Grafana instance with unmodified default credentials, utilized an unauthorized MCP tool server to gain cluster administrator privileges, and then used an automated platform to steal credentials to access the production environment and read customer databases. As a result of this incident, customer organization names, account holders' names, member email addresses, and password hashes were exposed. Since the attackers had access to the system containing node credentials, Chainstack has required customers to rotate their node credentials.