Crypto Infrastructure Firm Haruko Breached, Affecting 15 Institutional Clients

Crypto technology provider Haruko was hit by a targeted cyberattack this week that compromised 15 of its institutional clients, with some smaller hedge funds reportedly losing funds as a result. The breach exposed read only exchange API details and trading data belonging to affected customers.

According to messages reviewed from the company’s co-founder and chief technology officer, the impacted clients were those not using Haruko’s whitelist security feature, which limits system access to approved networks. The company has not responded to requests for comment.

How the Breach Happened

Sources familiar with the matter say the vulnerability stemmed from Haruko’s use of physical, dedicated servers rather than cloud infrastructure that typically includes additional built-in security protections. The attacker reportedly exploited a flaw in one of Haruko’s internal processes, extracting an access token that exposed data stored in system memory, including API credentials.

Client login credentials on their own systems were not compromised directly; the breach originated from Haruko’s own infrastructure. The company said it has since patched the vulnerability and refreshed its security credentials, while urging clients to implement IP whitelisting for added protection.

Part of a Growing Trend

Haruko provides risk-management and trading infrastructure to institutional digital-asset firms, connecting with exchanges, custodians, and blockchain networks. The company says it serves more than 80 clients worldwide.

This incident adds to a rising wave of cyberattacks targeting crypto firms. Industry data shows a sharp increase in attacks during the first half of the year compared to the same period last year, with infrastructure-related breaches accounting for a disproportionate share of total losses despite representing a smaller number of incidents overall.