Crypto tech provider Haruko hit by cyberattack affecting 15 clients, some funds lost
Reported by CoinDesk · AI-assisted summary by ChikoCorp AI News Desk
AI-generated summary based on the linked source; not independently verified. This is not investment advice. Verify market-moving details at the original publisher before acting. See our editorial policy, AI content policy, and financial disclaimer.
Summary
Crypto technology provider Haruko experienced a targeted cyberattack affecting 15 of its clients, exposing read-only exchange API details and trading data. Some smaller hedge-fund clients with weaker security controls reportedly lost a small amount of funds. Haruko patched the vulnerability and refreshed its server-side secrets after the breach.
Why it matters
The source highlights the breach amid increasing cyberattacks on crypto companies, emphasizing the risks of irreversible transactions and reliance on digital credentials. The incident underlines security vulnerabilities in crypto infrastructure that can lead to asset losses and data exposure.
Key context
Haruko serves institutional digital-asset firms by providing portfolio, risk-management, and trade-data infrastructure, connecting with multiple centralized exchanges, custodians, blockchains, and DeFi protocols. The attack exploited a vulnerability in Haruko’s bare-metal server infrastructure, allowing extraction of a user-access token from process memory. Affected clients were non-whitelisted, meaning they lacked IP-based communication restrictions.
Key numbers and entities
Haruko, Bitcoin Suisse, GSR, Flowdesk, 3iQ Digital Assets, M2, Ampersan, MNNC Group (Monarq Asset Management), and Trovio Asset Management are mentioned. Haruko reportedly serves more than 80 clients globally and connects with over 100 centralized trading venues, 30 blockchains, and 250 onchain protocols. TRM Labs reported 207 crypto attacks in the first half of 2026, resulting in $972 million stolen.
What remains unclear
The source does not specify the exact amount of funds lost or which clients were most affected beyond "smaller hedge funds." Haruko did not comment on details, and it remains unclear how many assets were recovered or the precise technical details of the vulnerability.