Blockchain Data Provider Allium Revokes Every Customer API Key After a Breach and Has Not Said How Attackers Got In

Allium, a company that supplies indexed blockchain data to institutions, has confirmed unauthorized access to its systems. Its customers include Visa, Stripe and Coinbase. Allium's chief executive, Ethan Chan, disclosed the breach on October 25, according to The Defiant. The company said it restricted access, notified affected customers and hired an independent cybersecurity firm.

Allium revoked all existing application programming interface (API) keys and told customers to change passwords and turn on multifactor authentication. By October 28 its Explorer product and associated APIs were operational again, but customers had to meet new security requirements before resuming normal use. Allium has not identified the attacker, explained how the access occurred, or said whether customer information was taken.

The incident is the second in a week in which a crypto company's exposure ran through a software vendor rather than through its own wallets. Coinbase says it was not breached and that customer funds were unaffected by an incident at Amplitude, a product-analytics vendor. CryptoSlate reports that disclosures filed in South Korea describe different categories of exposed data than Coinbase's public statement, and that customer risks there remain unresolved. Coinbase's position and the Korean filings have not been reconciled publicly.

Neither incident moved coins on-chain. The risk is downstream. Payment companies and exchanges use API keys and data pipelines like Allium's to monitor transactions, run compliance checks and price assets. Leaked identity or behavioral data gives fraudsters the context they need to impersonate support staff convincingly.