Allium, a company that sells blockchain data to banks, exchanges and crypto firms, confirmed on 28 October 2026 that an intruder gained unauthorized access to some of its systems. In a blog post signed by chief executive and co-founder Ethan Chan, the company said it identified the incident on 25 October, secured its systems, notified affected customers directly and hired an outside cybersecurity firm. Its status page adds that existing API keys are being revoked and that every user must set a new password. What Allium has not said is what the intruder could see.
The Allium breach kept its Explorer, the SQL tool customers use to query blockchain data, out of service for about two and a half days. It came back on 28 October at 09:00 EDT (13:00 UTC). Parts of the platform were still listed as down on 29 October, and the uploaded-data features had not been switched back on.
Allium lists Visa and Coinbase among its customers on its own website. That is the only link between them and this incident: Allium has not said that either company was affected, and neither has commented. Nothing published so far points to any loss of funds.
Allium security incident: what the company confirmed on 28 October
The statement is short. Allium says it “identified a security incident involving unauthorized access to certain Allium systems”. The post gives a day, 25 October, but no hour. It says access was restricted, systems were secured, affected customers were notified directly and an independent cybersecurity firm, which Allium does not name, was brought in for the response and the investigation.
According to the post, the core platform is back: the Allium App, Explorer and the Explorer APIs. “Some features remain temporarily unavailable as recovery continues,” Chan wrote. Allium says it is strengthening its controls, naming authentication and monitoring, and will publish a summary of findings after the investigation, with no date given. The Defiant reported the same picture: core services back, uploaded-data access still disabled, gaps in some data feeds still being filled.
What Allium has not said
The blog post confirms an intrusion and a response. It does not describe the damage. Four questions a customer would ask are left open.
- Which data the intruder reached: customer queries, files that customers uploaded, account credentials, or the API keys themselves.
- Whether any data left Allium’s systems, or whether access was cut before that.
- How the attacker got in, and whether that entry point is now closed.
- How many customers were notified, and which ones.
No group had claimed the attack as of 29 October, according to Journal du Coin. Allium points readers to its trust page, trust.allium.so; when we checked on 29 October, it said nothing about the incident.
The reason for revoking the keys is not given either. Companies revoke every existing key when they cannot rule out that keys were seen, and also as a cheap precaution while they do not yet know. Allium does not say that keys were exposed, and it does not say they were not.
A two-and-a-half-day outage, from maintenance screen to restored APIs
The Allium status page records the sequence. Its times are in US Eastern time (EDT); we converted them to UTC. One line, the time of the blog post, comes only from Journal du Coin.
| Date and time (UTC) | Event | Source |
|---|---|---|
| 25 Oct | Allium identifies unauthorized access to some systems | Allium blog |
| 25 Oct, 23:31 | Explorer listed as under maintenance and unavailable | Allium status page |
| 26 Oct, 15:39 | Allium App taken offline as a precaution | Allium status page |
| 26 Oct, 22:09 | Datashare tables in all regions stop receiving new data | Allium status page |
| 27 Oct, 22:00 | Datashare delivery resumes for all chains, with possible small gaps | Allium status page |
| 28 Oct, 13:00 | Explorer and Explorer API back online; existing API keys revoked, new passwords required, uploaded data disabled | Allium status page |
| 28 Oct, 14:59 | “Explorer Outage” incident marked resolved | Allium status page |
| 28 Oct, 15:00 | Allium Assistant and MCP still unavailable | Allium status page |
| 28 Oct, about 15:00 | Blog post by CEO Ethan Chan | Journal du Coin (the post itself carries only the date) |
| 28 Oct, 19:47 | Datashare delivery normal on Snowflake, Databricks and BigQuery; Hyperliquid and BigQuery backfill still in progress | Allium status page |
The status page does not explain the gap between detection on 25 October and the decision to take the app offline the next afternoon. When we looked at it around 12:30 UTC on 29 October, it still showed a partial outage for Explorer UI and queries, and degraded performance for Datashares on Hyperliquid and several groups of chains.
Visa and Coinbase are Allium customers, not named victims
Several headlines have put Visa and Coinbase next to the word breach. The link is narrower. Allium’s website shows logos of Visa, Coinbase, Standard Chartered, the Monetary Authority of Singapore, Boston Consulting Group, MetaMask, a16z crypto, Phantom, MoonPay, Uniswap and Grayscale, names KPMG, and says more than 30 of the Fortune Crypto 100 run on its data. The same site says Visa publishes a public stablecoin dashboard built on Allium data.
None of that says whether any of these firms was among the customers Allium notified. Allium has named no affected customer, and nothing so far says that Visa or Coinbase systems, accounts or funds were touched.
Allium says it holds SOC 1 and SOC 2 Type I and Type II reports, the audits large customers usually require from suppliers. Journal du Coin adds that the company was founded in 2021, indexes more than 150 blockchains and raised a $40 million Series B on 23 June 2026 led by Amplify Partners.
Allium API keys revoked: what customers have to do now
The status page is the one place where Allium gives practical instructions.
- Create a new API key in the Allium app, because existing keys are being revoked. If your keys were issued directly by an Allium contact, wait for that person to send the new one.
- Set a new password at the next sign-in.
- Turn on multi-factor authentication, which Allium recommends.
- Expect uploaded data to be unavailable for now: new uploads are disabled, previously uploaded data cannot be accessed, and queries that use it will not run.
- Check dashboards, compliance tools and reports fed by Allium Datashares for gaps between 26 and 28 October, when delivery stopped and was later backfilled.
One step goes beyond what Allium asks. If files you uploaded contained secrets of your own, such as credentials or keys for other services, rotate them. Allium has switched off access to exactly that part of the platform without saying why.
For people who simply hold crypto, the direct risk looks limited. Allium reads public blockchains and serves the results; nothing it has published suggests it holds customer funds. The indirect risk is the usual one after a leak: messages that cite the incident to look credible. Be wary of any e-mail or call that mentions Allium and asks for a password, a code or a transfer.
The third supplier incident in a week
On 28 October Coinbase said its own systems were not breached but that its analytics vendor Amplitude had exposed contact data of some customers; SlowMist puts the number of contacts above 70,000, Journal du Coin reports. A day earlier, SlowMist described a tampered Udesk customer-chat script that copied login data and swapped deposit addresses on the sites that loaded it.
Before that, on 21 October, the cloud host Railway told all its users to rotate their secrets, as we reported in our coverage of the Railway breach.
In each case the company’s own wallets and code were not the way in. The leak came through an analytics script, a help-desk widget, a cloud host or, now, a data vendor. Allium sits further back in that chain than a chat widget, because customers send it their queries, their uploaded files and their credentials.
What an on-chain data provider does
Blockchains are public, but raw blockchain data is hard to use. To know who sent how much of which token, through which app, someone has to run nodes, read every block, decode each transaction and load the results into tables analysts can query.
Allium sells that work in several forms, according to its website: a SQL tool called Explorer, developer APIs, real-time Datastreams, an AI assistant, a Terminal, and Datashares, which deliver ready-made tables into a customer’s own Snowflake, Databricks or BigQuery account. A payment network can track stablecoin volumes this way, and a bank can feed a compliance tool without running a node for each chain.
The chain data itself is public, so there is little to steal there; we explain where crypto hacks really happen in our guide to whether a blockchain can be hacked. What a provider holds that is not public is its customers’ activity. Their queries can show which addresses or tokens they are watching.
What to watch next
The promised summary of findings should say what was accessed, how, and whether anything was taken. Until it comes, the status page is the place to watch: the Allium Assistant, MCP access and uploaded-data features were still off at the last update. If personal data of people in the European Union was involved, GDPR notification duties would apply; Allium has not addressed that point.