Glassnode, a provider of on-chain analytics for digital assets, has notified its users about a potential compromise of customer information and is urging heightened awareness of phishing risks that could follow. The Swiss-based platform, widely used by traders and institutions for market intelligence on Bitcoin, Ethereum, and other cryptocurrencies, indicated that it is actively investigating reports of unauthorized data access while emphasizing that core systems handling blockchain metrics remain unaffected.
According to intelligence shared across cybersecurity channels, an unidentified actor has been advertising what they claim is a large database taken from Glassnode around May 2026.
The offered material reportedly covers details for approximately 850,000 accounts, including information pulled from customer management records such as profile data, protected login credentials, subscription levels, API access details, preferences for marketing outreach, referral links, and related analytics fields.
These assertions have not been independently confirmed, and Glassnode has described the situation as under review without validating the scale or authenticity of the claims.
The alert underscores ongoing vulnerabilities in the cryptocurrency industry, where even non-custodial data platforms can become targets.
Should the reported exposure prove accurate, attackers could exploit account metadata and API keys to launch convincing social engineering campaigns.
Such efforts often involve impersonating official communications with tailored messages that reference user history, such as past platform activity or subscription details, to trick recipients into revealing further credentials or clicking harmful links.
This type of incident fits a familiar pattern seen across crypto services, where leaked customer lists enable targeted attacks against engaged users who hold or analyze digital assets.
Previous breaches at similar firms have demonstrated how exposed contact information fuels extended phishing waves, including fake security warnings and requests to verify accounts through fraudulent portals.
For a platform like Glassnode, whose audience includes both retail participants and institutional players, any validated leak would represent a valuable resource for criminals seeking high-value targets.
In response, the company is advising clients to exercise caution with incoming messages.
Users should update passwords immediately if there is any overlap with other services, activate strong multi-factor authentication, and generate new API credentials only through verified channels on the official site.
Direct navigation to studio.glassnode.com is recommended rather than relying on emailed links, and any suspicious outreach should be reported directly to support teams.
Monitoring account activity and financial statements for irregularities is also encouraged as a standard precaution.
The episode serves as a timely reminder of broader best practices in digital asset management.
Minimizing unnecessary data sharing, regularly rotating access tokens, and maintaining a zero-trust approach to communications can significantly reduce exposure.
As investigations continue, Glassnode has committed to providing further details to its community while prioritizing the security and trust that underpin its services.
Users and organizations dependent on such analytics tools are encouraged to remain vigilant in the coming weeks, as delayed exploitation of compromised information is common in these cases. This incident highlights the changing threat landscape and the importance of proactive defenses even for platforms focused primarily on data insights rather than asset custody.