Institutional crypto-technology provider Haruko suffered a targeted cyberattack earlier this week that affected 15 of its clients, according to people with knowledge of the incident, exposing customers' read-only exchange API credentials and trading data.

Haruko, a London-based firm, supplies portfolio, risk-management and trade-data infrastructure to institutional digital-asset firms. Its platform connects to centralized exchanges, custodians, blockchains and decentralized-finance protocols, giving clients a single consolidated view of positions, transactions and risk exposure. The exposed interfaces — application programming interfaces, the channels through which client systems and Haruko's platform communicate — served read-only connections to exchange accounts holding and trading assets such as Bitcoin (BTC), alongside spot and contract trading records. That consolidation is also what gives a single vendor incident a wide blast radius: many institutions' exchange connectivity and trading records intersect at one infrastructure provider, which is how one intrusion surfaced across 15 client relationships at once.

The scope of the financial damage remains unclear. Sources indicated that a small amount of client funds was stolen and that smaller hedge funds with weaker security controls may have been particularly exposed. Haruko has not publicly confirmed client-level losses and did not respond to repeated requests for comment.

Because crypto transactions are generally irreversible, and because platforms rely on digital credentials and signing systems that can hand attackers direct access to assets, institutional risk teams treat even a modest leak of venue-side credentials as a serious event.

The breach touched all of Haruko's non-whitelisted customers. The firm does not disclose its full client roster, but its website names Bitcoin Suisse, GSR, Flowdesk, 3iQ Digital Assets, M2, Ampersan, MNNC Group — now operating as Monarq Asset Management — and Trovio Asset Management as clients. A GSR spokesperson said the firm had not been impacted by any rumored breach; the other named firms had not commented at the time of writing. Read-only access is the standard permission tier for the monitoring and reporting tools that aggregation platforms like Haruko's run on. The read-only scope of the leaked keys means they could not by themselves move funds, but the stolen trading data gives an attacker a precise map of where institutional assets sit — a dynamic that, per the report's assessment, may leave smaller funds with thinner monitoring most exposed to subsequent losses.

Token Extraction, Not Credential Theft

Haruko's own account of the incident, relayed by co-founder and chief technology officer Adam Carlile in messages to clients, points to the company itself — not any individual customer — as the target. Carlile described a targeted attack on Haruko by a group, put the impact at 15 clients, and laid out the intrusion path: the attacker exploited a vulnerability in one of the firm's processes, extracted a user-access token — a standing credential that authenticates its holder to a system without the user's own login being involved — and used it to capture data held in that process's memory, which could have included the read-only exchange API details and other client data.

Client login credentials were not compromised on customers' own systems; the token was pulled from Haruko's infrastructure instead.

Architecture also played a role. Haruko runs bare-metal servers — physical machines used exclusively by the firm — rather than cloud services such as Amazon Web Services, which layer on additional security controls, one person familiar with the matter said. Dedicated hardware reduces shared-tenant exposure, but it places the full burden of hardening, patching and access control on the operator's own team. Because the affected parties were the company's non-whitelisted clients — and a whitelist permits communication only with approved machines — the 15 impacted customers were by definition outside that protective perimeter.

Remediation and Post-Mortem

Haruko said it has fixed the vulnerability and refreshed its server-side secrets. It told clients that configuring an inbound IP whitelist restricting access to specified internet addresses would provide "maximum protection." A full technical post-mortem is planned.

The company says it serves more than 80 clients globally and connects with over 100 centralized trading venues, 30 blockchains — spanning major Layer 2 environments built on top of base networks — and 250 onchain protocols, covering the DeFi venue class to which protocols such as Ether.fi (ETHFI) belong.

A Record Year for Crypto Attacks

The Haruko incident lands in a record year for attacks. Industry incident data counted 207 hacks in the first half of 2026, more than double the 83 recorded a year earlier, with combined losses of $972 million. Infrastructure and operational compromises made up only about 15% of incidents yet roughly 76% of the money stolen — a pattern that the report describes the access-token-and-memory technique used in this case as exemplifying.

The decisive primary evidence will be the promised technical post-mortem, which is expected to name the vulnerable process, confirm the on-chain movement of any stolen funds and quantify the loss. Until then, the confirmed remediation stands at the code fix, refreshed secrets and IP whitelisting.