# Blockchain data provider Allium discloses unauthorized access, revokes all API keys · pwn.watch > Allium, a blockchain data provider whose query tools, APIs and warehouse data feeds are used by companies including Visa and Coinbase, disclosed on Oct 28 2026 that it detected unauthorized access to some of its systems on Oct 25. The Allium App and Explorer were offline for about two and a half days. When Explorer and its API came back on Oct 28, Allium revoked existing API keys, required new passwords and recommended MFA, disabled uploading and reading previously uploaded data, and kept Allium Assistant and the Allium MCP offline. It says affected customers were notified directly and an independent security firm is investigating, but it has not said which systems were reached or whether customer data was exposed. Page: https://pwn.watch/i/allium-blockchain-data-unauthorized-access-oct-2026 · generated 2026-10-29T06:31:56.147Z ## Status - Severity: medium · status: live · patch: partial - Product: Allium blockchain data platform (App, Explorer, Explorer API, datashares) - Started: 2026-10-25 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/allium-blockchain-data-unauthorized-access-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/allium-blockchain-data-unauthorized-access-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/allium-blockchain-data-unauthorized-access-oct-2026.json - This file: https://pwn.watch/i/allium-blockchain-data-unauthorized-access-oct-2026/llms.txt ## Updates (newest first) - 2026-10-28: Allium Explorer and Explorer API come back online. Existing API keys are revoked, users must set a new password (MFA recommended), uploading and accessing previously uploaded data is disabled, and Allium Assistant and the Allium MCP stay unavailable. (https://status.allium.so/) - 2026-10-28: CEO and co-founder Ethan Chan discloses that Allium detected unauthorized access to some of its systems on Oct 25, says affected customers were notified directly and an independent cybersecurity firm was engaged; the company has not said which systems were accessed or whether customer data was exposed. (https://cryptonews.net/news/security/33668278/) - 2026-10-26: Allium takes the whole Allium App offline as a precaution while it works on restoring services. (https://status.allium.so/) - 2026-10-25: Allium's Explorer goes offline; the status page first describes it as maintenance and an Explorer outage. (https://status.allium.so/) ## Fix brief # Security brief: Blockchain data provider Allium discloses unauthorized access, revokes all API keys Source: https://pwn.watch/i/allium-blockchain-data-unauthorized-access-oct-2026 · status: live · severity: medium · updated Oct 29, 2026, 06:26 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Allium, a blockchain data provider whose query tools, APIs and warehouse data feeds are used by companies including Visa and Coinbase, disclosed on Oct 28 2026 that it detected unauthorized access to some of its systems on Oct 25. The Allium App and Explorer were offline for about two and a half days. When Explorer and its API came back on Oct 28, Allium revoked existing API keys, required new passwords and recommended MFA, disabled uploading and reading previously uploaded data, and kept Allium Assistant and the Allium MCP offline. It says affected customers were notified directly and an independent security firm is investigating, but it has not said which systems were reached or whether customer data was exposed. Severity detail: Confirmed unauthorized access with precautionary revocation of all API keys and passwords; scope and any data exposure not yet disclosed - Product: Allium blockchain data platform (App, Explorer, Explorer API, datashares) ## Affected versions - Not specified in the data. Check the advisories below. ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes If you use Allium, create a new API key in the app (old keys are revoked), set a new password and turn on MFA, and rotate any credentials or secrets that were stored in or passed through Allium, including anything in uploaded tables. Watch for Allium-themed phishing asking you to re-enter keys. ## Latest updates - Oct 28, 2026: Allium Explorer and Explorer API come back online. Existing API keys are revoked, users must set a new password (MFA recommended), uploading and accessing previously uploaded data is disabled, and Allium Assistant and the Allium MCP stay unavailable. - Oct 28, 2026: CEO and co-founder Ethan Chan discloses that Allium detected unauthorized access to some of its systems on Oct 25, says affected customers were notified directly and an independent cybersecurity firm was engaged; the company has not said which systems were accessed or whether customer data was exposed. - Oct 26, 2026: Allium takes the whole Allium App offline as a precaution while it works on restoring services. - Oct 25, 2026: Allium's Explorer goes offline; the status page first describes it as maintenance and an Explorer outage. ## Advisories - [Allium Status](https://status.allium.so/) (Allium) ## Write-ups & news - [Allium Discloses Security Breach, Revokes API Keys](https://cryptonews.net/news/security/33668278/) - [Allium: Disclosed recent unauthorized access, core platform has resumed online operations](https://www.chaincatcher.com/en/article/2299822) ## Caveats Allium plans to publish a summary of its findings after the investigation. Datashare gaps from the affected window were still being backfilled for some chains on Oct 28, and uploaded-data features remain disabled. --- Machine-readable: https://pwn.watch/i/allium-blockchain-data-unauthorized-access-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.