A breach at web infrastructure provider Vercel is forcing crypto teams to rotate API keys and do a deep inspection of their underlying code.

In a bulletin, Vercel said the hacker was able to grab behind-the-scenes settings that weren’t locked down, potentially exposing API keys — the digital credentials apps use to connect to other services. Those credentials act like digital passwords, allowing software to connect to databases, crypto wallets, and external services. In the wrong hands, they can be used to impersonate an app, burn through usage limits, or manipulate how it runs.

A post on cybercrime forum BreachForums claimed to be selling Vercel data for $2 million, including access keys and source code, though those claims have not…