# Blockchain Data Provider Allium Revokes Every Customer API Key After a Breach and Has Not Said How Attackers Got In

Allium serves Visa, Stripe and Coinbase, and its services are back online, but the company has not said whether customer data left its systems, while Coinbase faces separate questions about an incident at the analytics vendor Amplitude.

- Published: 2026-10-29T05:42:25.188Z
- Canonical: https://polylog.news/crypto/2026-10-29/blockchain-data-provider-allium-revokes-every-customer-api-k
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [crypto.news](https://crypto.news/allium-security-breach-api-keys-platform-recovery/), [CryptoSlate](https://cryptoslate.com/coinbase-says-it-wasnt-breached-but-hackers-dont-need-to-steal-crypto-to-hurt-users/)

Allium, a company that supplies indexed blockchain data to institutions, has [confirmed unauthorized access to its systems](https://crypto.news/allium-security-breach-api-keys-platform-recovery/). Its customers include Visa, Stripe and Coinbase. Allium's chief executive, Ethan Chan, disclosed the breach on October 25, [according to The Defiant](https://thedefiant.io/news/security/allium-discloses-security-breach-revokes-api-keys). The company said it restricted access, notified affected customers and hired an independent cybersecurity firm.

Allium revoked all existing application programming interface (API) keys and told customers to change passwords and turn on multifactor authentication. By October 28 its Explorer product and associated APIs were [operational again](https://www.kucoin.com/news/flash/allium-core-platform-restored-after-unauthorized-access-incident), but customers had to meet new security requirements before resuming normal use. Allium has not identified the attacker, explained how the access occurred, or said whether customer information was taken.

The incident is the second in a week in which a crypto company's exposure ran through a software vendor rather than through its own wallets. Coinbase [says it was not breached](https://cryptoslate.com/coinbase-says-it-wasnt-breached-but-hackers-dont-need-to-steal-crypto-to-hurt-users/) and that customer funds were unaffected by an incident at Amplitude, a product-analytics vendor. CryptoSlate reports that disclosures filed in South Korea describe different categories of exposed data than Coinbase's public statement, and that customer risks there remain unresolved. Coinbase's position and the Korean filings have not been reconciled publicly.

Neither incident moved coins on-chain. The risk is downstream. Payment companies and exchanges use API keys and data pipelines like Allium's to monitor transactions, run compliance checks and price assets. Leaked identity or behavioral data gives fraudsters the context they need to impersonate support staff convincingly.

## What this means

The channel of exposure is the data and analytics layer that regulated firms bought to meet compliance and product needs. Each vendor adds another place where customer identities and transaction patterns sit outside the exchange's own controls. Visa, Stripe and Coinbase can rotate keys quickly, so the operational outage is already contained. The open variable is whether personal data was exfiltrated, because stolen personal data feeds the impersonation scams that now cost holders more than code exploits do. The 2022 breach at Twilio is the closest precedent: attackers used a communications vendor's systems to reach downstream crypto and technology users. Consensus treats vendor incidents as a side issue next to exchange hacks. The desk reads the opposite for retail losses. The likelier outcome is a wave of targeted phishing aimed at users of affected platforms within weeks if Allium or the Amplitude disclosures confirm that personal data left the systems. That read is wrong if forensic findings show the access touched only internal infrastructure and no customer records.

## What to watch

- Allium's forensic report, specifically whether it states how the attacker gained access and whether customer data was copied. That determines whether downstream firms must notify their own users.
- Whether Coinbase publicly addresses the gap between its statement and the South Korean disclosures, which would show how far the exposure reached.
- A rise in support-impersonation scams targeting customers of the named firms, which would be the first observable sign that leaked data is being used.