Allium, a blockchain data provider whose customers include Visa, Stripe, and Coinbase, confirmed that an unauthorized access incident on October 25, 2026 disrupted enterprise blockchain data services and forced a wave of API key revocations.
The company detected the breach and immediately restricted access, notified affected clients, and engaged an independent cybersecurity firm. CEO and co-founder Ethan Chan said Allium was strengthening authentication and monitoring controls while the investigation continues. The attacker has not been identified, and the company has not disclosed whether customer information was stolen.
By October 28, Allium had restored its main application and Explorer APIs, but some features remained unavailable, including the Allium Assistant and its Model Context Protocol service. Existing API keys were revoked, and customers were instructed to generate new credentials, reset passwords, and enable multifactor authentication. Some datasets required backfilling and verification, with Ethereum, Bitcoin, Solana, and Base tables among those being checked on Snowflake and Databricks. Data delivery to Snowflake, Databricks, and Google BigQuery had been interrupted, causing stale query results or errors.
The security incident follows Allium's $40 million Series B funding round announced in June, led by Amplify Partners with participation from Kleiner Perkins and Theory Ventures. Previously, the company raised $16.5 million in Series A funding in 2024. Allium's infrastructure supports data operations across more than 150 blockchains, and its research has been cited in stablecoin payment analysis, with estimates of $401 billion to $527 billion in payments through August 2026. The disruption raises concerns about data integrity and security protocols for institutional blockchain analytics, though there is no indication that Visa, Stripe, or Coinbase's own systems were breached.
