Allium Discloses Security Breach, Revokes API Keys as Core Services Return

Published October 29, 2026, 12:10 PM PKT. Based on Allium's official security update from CEO and co-founder Ethan Chan dated October 28, 2026, Allium's public incident history, crypto.news coverage dated October 29, 2026, and The Defiant coverage dated October 29, 2026 (primary and secondary sources below). This is the first MABOnChain article on the Allium security incident.

Allium, the blockchain data provider whose customers include Visa, Stripe and Coinbase, disclosed unauthorized access to some of its systems on October 28, 2026, three days after detecting the incident on October 25, according to a security update from CEO and co-founder Ethan Chan. Allium restricted access after detecting the intrusion, notified affected customers directly, hired an independent cybersecurity firm to investigate, and revoked existing API keys, while restoring its core application and Explorer APIs by October 28. Several features remained unavailable at the time of the disclosure, and Allium has not identified the attacker, explained how the unauthorized access occurred, or said whether customer information was exposed.

Unauthorized access found on October 25

The timeline in Allium's public incident history shows how the incident unfolded across four days. Its Explorer became unavailable on October 25, the day the unauthorized access was detected, and recovery work continued through October 28, according to crypto.news, which reviewed the incident history. Allium temporarily took its application offline on October 26 as a precaution while staff worked to restore access. By October 28, the Explorer and its associated APIs were operational again, but customers faced additional security requirements before resuming normal use.

Chan's statement, quoted by crypto.news, said: "On October 25, we identified a security incident involving unauthorized access to certain Allium systems. We took immediate steps to restrict access and secure our systems. We have notified affected customers directly and are continuing to provide updates and support." He added: "We are sorry for the disruption this has caused our customers," and said Allium intended to publish its findings and corrective measures after the investigation. The company has not announced when that report will be released.

API keys revoked, passwords reset

The most immediate consequence for customers is credential rotation. Existing API keys were being revoked, and customers were instructed to generate replacements through the application or obtain new credentials from their Allium contacts, according to crypto.news. The company also recommended that customers reset passwords and enable multifactor authentication. API keys authenticate requests to software interfaces, so revoking previously issued keys restricts the use of credentials that may have been exposed while the incident is investigated, even before Allium says what, if anything, was taken.

That distinction matters because Allium has not answered the central question. The disclosure does not establish that Visa, Stripe or Coinbase suffered unauthorized access to their own systems, crypto.news noted, and Allium confirmed it notified affected customers directly but did not identify those recipients. Until Allium's investigation concludes, customers cannot tell from the public statement whether their data, their queries, or only Allium's internal systems were reached.

What is back, and what is still down

By October 28, Allium's core platforms, the Allium App, Explorer and Explorer APIs, were back online, according to the company's statement as reported by Binance News and KuCoin's news desk, both citing Odaily's account of Chan's update. But the recovery was partial. Access to previously uploaded datasets and the ability to upload new data remained temporarily disabled, meaning queries relying on those tables could not run. Allium Assistant and the company's Model Context Protocol service, which lets AI tools query Allium data, were still unavailable in the October 28 recovery notice.

Allium said it was strengthening its authentication and monitoring controls as the investigation continued, with a focus on the controls that govern who can reach its systems and how quickly unusual activity is spotted. The company also committed to sharing a summary of its findings and response measures once the forensic investigation concludes, a standard post-incident step that will be the first real test of how much Allium is willing to disclose about the intrusion.

The data gaps behind the restored APIs

Restoring an API is not the same as restoring the data behind it, and Allium's own status notices make that gap explicit. An October 26 status update warned that datashare tables across regions were no longer receiving fresh data, so customers querying those tables could encounter stale results or errors until delivery resumed, crypto.news reported. Allium subsequently reported that data distribution had restarted across Snowflake, Databricks and Google BigQuery, the warehouse platforms its enterprise customers use, but it continued checking for missing records and backfilling information from the affected period.

By October 28, Ethereum, Bitcoin, Solana and Base datasets on Snowflake and Databricks were among those undergoing freshness and completeness verification, with backfilling continuing for other chains and affected BigQuery records. For customers using blockchain datasets in research, accounting or monitoring, that means an operational endpoint does not yet guarantee a complete record of transactions during the outage, a caveat that matters for any analysis built on Allium data from October 25 onward.

Why a data provider breach travels further

Allium, founded in 2021, collects, organizes and analyzes blockchain transactions for institutional customers, turning raw onchain activity into structured datasets used for financial research, payments analysis and business applications. Visa works with Allium on its Onchain Analytics Dashboard, which classifies stablecoin transactions and distinguishes payment activity from trading, transfers and other blockchain operations. Crypto.news cited Allium research in an October examination estimating between $401 billion and $527 billion in stablecoin payments through August 2026, depending on the classification method.

The incident also lands four months after Allium's $40 million Series B fundraising announcement in June 2026, led by Amplify Partners with participation from Kleiner Perkins and Theory Ventures. At the time, the company said its technology supported data operations across more than 150 blockchains, after a $16.5 million Series A round in 2024 to develop enterprise blockchain infrastructure. A breach at a provider that sits between blockchains and the institutions reading them does not need to touch customer funds to matter: it touches the data those institutions trust, and the key revocations, password resets and backfilling now under way are the visible cost of re-establishing that trust.

What Allium has not said yet

Four questions remain unanswered, and they decide how serious this incident turns out to be. First, how the unauthorized access occurred, which Allium has not explained. Second, whether customer or end-user data was exposed, which Allium has not disclosed. Third, who the attacker was, which Allium has not identified. Fourth, when the promised post-investigation summary will arrive, which Allium has not dated. Its latest status notices continue to track outstanding feature restoration, data verification and repairs to affected records.

Until those answers arrive, the facts are narrow but significant: a data provider used by Visa, Stripe and Coinbase detected unauthorized access on October 25, took core services offline and then restored them by October 28, revoked its customers' API keys, and is still backfilling data and restoring features. MABOnChain will update this story when Allium publishes its investigation summary or confirms whether customer data was exposed.

This article is news reporting and is not investment advice.

Sources

• Allium, Official security update from CEO and co-founder Ethan Chan (October 28, 2026), primary source for the October 25 detection, access restrictions, customer notification, independent investigation, core service restoration, and planned findings summary
• Allium, Public incident history (October 25 to 28, 2026), primary source for the Explorer outage, October 26 application precaution, data delivery interruptions, and backfilling status
• crypto.news, Allium security breach disrupts services used by Visa, Stripe, Coinbase (October 29, 2026), secondary source for the Chan statement quotations, API key revocation instructions, warehouse platform recovery, Visa dashboard work, and the $40 million Series B round
• The Defiant, Allium Discloses Security Breach, Revokes API Keys (October 29, 2026), secondary source for the disclosure summary and the status of uploaded-data access and data recovery