Crypto tech provider Haruko hit by cyberattack affecting 15 clients, some funds lost

London‑based crypto‑technology firm Haruko disclosed that a targeted cyberattack compromised data for 15 of its institutional clients. The breach exposed read‑only exchange API details and trading data, and a small amount of client funds was reportedly stolen.

Scope of the breach

The incident affected only Haruko’s non‑whitelisted clients, meaning those without an inbound IP whitelist restricting access. The attacker exploited a vulnerability in Haruko’s infrastructure, extracting a user‑access token from server memory and using it to capture read‑only API credentials and trading information.

Impact on clients

According to sources, smaller hedge‑fund clients with weaker security controls were most exposed, and a limited amount of assets was taken. Trading data was also taken. Haruko confirmed that client login credentials on their own systems were not compromised.

Haruko’s response

Haruko has patched the vulnerability, refreshed its server‑side secrets, and advised clients to configure inbound IP whitelists for maximum protection. The company plans to publish a full technical post‑mortem and noted that it serves over 80 clients globally, connecting to more than 100 centralized venues, 30 blockchains, and 250 on‑chain protocols.

Industry context

Cyber incidents in the crypto sector are rising sharply. Data from TRM Labs shows 207 attacks in the first half of 2026, more than double the previous year, resulting in nearly $1 billion in losses. Infrastructure and operational compromises accounted for the majority of stolen funds despite representing a small share of total incidents.