Allium discloses breach, restores core platform after unauthorized access
Security & Exploits ·
The onchain data provider says it detected intruders in its systems on October 25 and has since brought its main services back online while some functions stay suspended.
Allium, which supplies blockchain data to fintech and crypto clients, confirmed that unidentified parties gained access to certain internal systems, according to a statement from CEO and co-founder Ethan Chan. The company said it moved quickly to cut off that access and lock down affected systems once the intrusion was found. Customers believed to be impacted were contacted directly, and the firm says it is continuing to send updates as its response proceeds.
To investigate the incident, Allium brought in an outside cybersecurity firm rather than handling the review internally. The company has indicated it intends to publish a findings summary once that investigation concludes, along with details on security changes it plans to implement, including upgrades to authentication and system monitoring.
Operationally, Allium says its principal offerings — the Allium App, its Explorer tool, and the associated Explorer APIs — are functioning again, though it acknowledges certain features have not yet been restored as recovery work continues. The company is directing customers to its status page and trust center for ongoing updates on service availability.
The breach drew attention because of the scale of Allium's client base: coverage of the incident noted that the data provider counts major payments and crypto companies, including Visa, Stripe, and Coinbase, among the firms it serves, as reported by WuBlockchain. That client roster raises the stakes of any unauthorized access, even though Allium has not specified which systems or data sets were touched.
Several questions remain open. Allium has not detailed what kind of data, if any, was exposed, how the unauthorized access was initially achieved, or which specific features are still offline. The promised post-investigation report has not yet been published, and it is unclear how long full restoration will take or whether any customers have reported downstream effects from the incident.