Allium, the blockchain data provider serving major financial institutions including Visa, Stripe and Coinbase, has confirmed unauthorized access to some of its systems, prompting API key revocations and service interruptions following an October 25 security incident.
Summary
- Allium identified unauthorized access to certain systems on October 25 and hired an independent cybersecurity investigator.
- The company restored its primary application and Explorer APIs after several days of service interruptions.
- Allium revoked existing API keys and recommended password changes and multifactor authentication for customers.
- Some datasets required backfilling, while Allium Assistant and its MCP service remained unavailable during recovery.
- Allium, whose customers include major financial institutions, raised $40 million in Series B funding in June.
According to an official security update, CEO and co-founder Ethan Chan said the company restricted access after detecting the intrusion, notified affected customers and hired an independent cybersecurity firm to investigate. Allium has restored its main application and Explorer APIs, although several features remain unavailable.
At the same time, the company has not identified the attacker, explained how the unauthorized access occurred or disclosed whether customer information was stolen.
Allium security breach forces API key resets
The company’s public incident history shows that its Explorer became unavailable on October 25, with recovery efforts continuing through October 28. Allium temporarily took its application offline on October 26 as a precaution while staff worked to restore access.
By October 28, the Explorer and associated APIs were operational again, but customers faced additional security requirements before resuming normal use. Existing API keys were being revoked, and customers were instructed to generate replacements through the application or obtain new credentials from their Allium contacts.
The company recommended resetting passwords and enabling multifactor authentication. Access to previously uploaded datasets and the ability to upload new data remained temporarily disabled, meaning queries relying on those tables could not run.
Allium Assistant and the company’s Model Context Protocol service were still unavailable in its October 28 recovery notice.
Blockchain data feeds recover after service disruptions
The incident coincided with interruptions to Allium’s data delivery services, which supply blockchain information to enterprise customers using platforms such as Snowflake, Databricks and Google BigQuery.
An October 26 status update warned that datashare tables across regions were no longer receiving fresh data. Customers querying those tables could encounter stale results or errors until delivery resumed.
Allium subsequently reported that data distribution had restarted across the three warehouse platforms. However, it continued checking for missing records and backfilling information from the affected period.
By October 28, the company said Ethereum, Bitcoin, Solana and Base datasets on Snowflake and Databricks were among those undergoing freshness and completeness verification. Backfilling continued for other chains and affected BigQuery records.
The distinction between restoring an API and completing historical data repairs is important for customers using blockchain datasets in research, accounting or monitoring applications. An operational endpoint does not necessarily mean every table contains a complete record of transactions during an outage.
Visa and Stripe data provider investigates unauthorized access
Founded in 2021, Allium specializes in collecting, organizing and analyzing blockchain transactions for institutional customers. Its services turn raw onchain activity into structured datasets used for financial research, payments analysis and business applications.
Visa works with Allium on its Onchain Analytics Dashboard, which classifies stablecoin transactions and distinguishes payment activity from trading, transfers and other blockchain operations.
In an October examination of stablecoin payment activity, crypto.news cited Allium research estimating between $401 billion and $527 billion in payments through August 2026, depending on the classification method.
The company’s datasets have featured in research beyond payments. An October analysis of Solana validator distribution used Allium alongside other sources to examine how staked SOL was distributed geographically.
The disclosure does not establish that Visa, Stripe or Coinbase suffered unauthorized access to their own systems. Allium confirmed that it notified affected customers directly but did not identify those recipients.
Allium breach follows $40 million funding round
The security incident follows Allium’s $40 million Series B fundraising announcement in June, led by Amplify Partners with participation from Kleiner Perkins and Theory Ventures.
At the time, the company said its technology supported data operations across more than 150 blockchains. Its previous Series A fundraising round brought in $16.5 million in 2024 to develop enterprise blockchain infrastructure.
Chan said the company was strengthening its authentication and monitoring controls as its investigation continued.
“We’re sorry for the disruption this has caused our customers,” he wrote, adding that Allium intended to publish its findings and corrective measures after the investigation.
The company has not announced when that report will be released. Its latest status notices continue to track outstanding feature restoration, data verification and repairs to affected records.
