Allium discloses unauthorized system access and revokes API keys during platform recovery
Allium detected unauthorized access Oct 25 and revoked API keys and required a new password Oct 28. Datashares and Assistant recovered Nov 2, and MCP Nov 5. Uploaded-data access remains separate. On Nov 6 Allium reports independently validated containment. Customer-data impact is under investigation.
- Disclosed
- Oct 28, 2026
- Updated Nov 7, 2026
- Severity
- Sharted
- No CVE: a breach, not a bug
- Splash zone
- Allium application and API customers, especially integrations using existing keys or uploaded tables
- cloud · crypto
- In the wild
- Yes
- Allium confirms unauthorized access; customer-data impact remains unspecified.
What happened
Allium’s security statement acknowledges access to some systems and says affected customers were notified directly. It does not identify the entry point, enumerate accessed customer data or provide a victim count. L3 reflects a developer-facing data provider’s confirmed intrusion and credential-reset requirements; it does not assert a mass data leak.
October 25 is the detection date. The incident date here follows the October 28 public security-reset and recovery notice, rather than treating an earlier maintenance/outage message as proof of public breach disclosure. Core service restoration is not equivalent to complete recovery: uploaded tables, AI/MCP functions and datashare verification have separate status. No link to the Binance or other bridge incidents is established.
The November 2 resolution applies specifically to datashare service degradation. At 16:22 UTC on November 2, the separate Explorer/API notice subsequently restored Allium Assistant for all users while leaving MCP recovery pending. Neither update lifts the October 28 uploaded-table restriction. No new root cause, customer-data scope or final forensic report is published in this resolution.
The November 5 update at 14:11 UTC restores MCP for all users. Public dashboard-link sharing remains in recovery. MCP availability does not establish restored uploaded-table access, a final forensic conclusion or resolved customer-data scope.
On November 6, Allium said the independent security firm it engaged had validated its containment measures. The company is still determining the full impact and plans to publish its findings once the investigation is complete. The validation gives no new feature-recovery or customer-data determination.
Crime-scene timeline
Oct 25, 2026
Allium detects unauthorized access, according to its later security statement
Oct 28, 2026
Recovery notice announces security resets and partial restoration
Existing API keys are being revoked; customers should create a new key or wait for one issued by their Allium contact. Password reset and MFA are recommended, while uploaded-data access and AI/MCP recovery remain restricted.
Oct 30, 15:03 UTC
All-chain datashare delivery and historical verification confirmed
Allium says Snowflake, BigQuery and Databricks datashares passed historical checks for all chains across all regions.
Nov 2, 15:38 UTC
Datashare incident marked resolved
This closes the datashare outage, not the security investigation or separate uploaded-data and AI/MCP restrictions.
Nov 2, 16:22 UTC
Allium Assistant restored for all users; MCP recovery still pending
The separate Explorer/API recovery notice confirms Assistant restoration but says more features, including MCP, will follow. It does not lift the uploaded-table restriction or close the security investigation.
Nov 5, 14:11 UTC
MCP restored for all users
The Explorer/API notice restores MCP; public dashboard-link sharing is still being brought back online. This does not announce uploaded-table recovery or completion of the security investigation.
Nov 6, 2026
Allium reports independent validation of containment
The forensic investigation continues to determine the full scope and impact. Allium plans a summary once it concludes.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Allium security statementPrimaryCEO Ethan Chan confirms unauthorized access detected October 25, direct notification and independent investigation. The November 6 update reports independent validation of containment and leaves customer-data impact open.
- Allium official status and recovery noticesPrimaryOctober 28 security-reset notice requires new API keys/password; distinguishes restored core services from uploaded data, AI/MCP and ongoing datashare validation.
- Allium full datashare incident historyPrimaryOctober 30 confirms all-chain delivery and historical verification; November 2 at 10:38 EST marks this datashare incident resolved. Other feature restrictions and the security investigation are separate.
- Allium separate Explorer/API recovery noticePrimaryNovember 2 at 11:22 EST restores Assistant; November 5 at 09:11 EST restores MCP for all users. Public dashboard-link sharing remains pending; uploaded-table recovery is not announced.