Allium, a blockchain data provider, disclosed that it detected unauthorized access to some of its systems on Oct. 25. The company said its core services are back online, though customers must replace API keys and contend with temporary restrictions on uploaded data.

"We have notified affected customers directly," CEO and co-founder Ethan Chan wrote in the Oct. 28 disclosure. The company did not name the affected customers, specify which systems were accessed, or say whether customer or end-user data was exposed.

Allium offers tools for querying blockchain activity, real-time data APIs, and data feeds that pipe into customers' cloud warehouses. Providers in this category sit between blockchains and the teams that analyze them, so disruptions at a data vendor affect the workflows of downstream users, not just the vendor's own systems. Its client roster includes Visa and Coinbase, and Visa's public onchain analytics dashboard identifies itself as powered by Allium. Neither company is named as affected in the security disclosure.

Recovery Requires New Credentials

In an Oct. 28 status update, Allium said existing API keys were being revoked as a security precaution. Revoking credentials is a standard containment step after unauthorized access, since it prevents potentially exposed keys from being reused. Customers should generate replacements within the app unless their Allium contact is supplying a new key. Users are also being asked to set new passwords, and the company recommends enabling multifactor authentication.

Uploading new data and accessing previously uploaded data remain temporarily disabled, meaning queries that rely on uploaded tables will not run. Allium Assistant and Allium MCP are also still unavailable, according to the company's status page.

Restored delivery does not yet mean all data gaps have been filled. In a datashare update at 3:47 p.m. ET on Oct. 28, Allium said delivery was operating normally across Snowflake, Databricks and BigQuery. However, it was still filling gaps from the affected window for some chains on Snowflake and Databricks, and for all chains on BigQuery, while work on Hyperliquid remained in progress.

Allium said it has engaged an independent cybersecurity firm to support its response and investigation and is strengthening authentication and monitoring. The company plans to share a summary of its findings and response measures once the investigation concludes — a follow-up in which the disclosure's open questions, including which systems were accessed and whether any data was exposed, may be addressed.