Crypto18 September, 20262 min read
Haruko Cyberattack Hits 15 Non-Whitelisted Crypto Clients, Exposes API Data And Trading Records
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Targeted cyberattack on Haruko affected 15 non-whitelisted hedge-fund clients. Breached data included read-only exchange API details and trading records.
6 outlets told this the same way.
Haruko breach hits 15
Crypto technology provider Haruko was hit by a targeted cyberattack that affected 15 clients and exposed read-only exchange API details and trading data, according to CoinDesk. CoinDesk reported that the attacker exploited a vulnerability in one of Haruko’s processes by extracting a user-access token and using it to capture data held in the process’s memory. Haruko said it fixed the vulnerability and refreshed its server-side secrets, and it told clients that configuring an inbound IP whitelist restricting access to specified internet addresses would provide "maximum protection."
CoinDesk also said the affected parties were all of Haruko’s non-whitelisted clients, and that clients’ login credentials were not compromised on their own systems. The breach comes as attacks on crypto companies are increasing in frequency, with TRM Labs counting 207 attacks in the first half of 2026 and $972 million in losses.
Token theft, client claims
Altcoin Buzz said the attacker exploited a vulnerability in one of Haruko’s processes, extracted a user-access token, and used it to capture data held in the process’s memory. Altcoin Buzz reported that 15 of Haruko's non-whitelisted hedge-fund clients had read-only exchange API details and trading data stolen, and that Haruko said all 15 affected parties had not configured Haruko's IP-whitelist feature. CoinDesk quoted a company spokesperson saying "GSR has not been impacted by any rumored breach," and it also quoted a 3iQ representative saying "3iQ was not affected by this breach."
CoinDesk further reported that a small amount of client funds was stolen, and that smaller hedge-fund clients with weaker security controls may have been particularly exposed. CoinDesk said Haruko did not disclose its full customer roster, but its website names Bitcoin Suisse, GSR, Flowdesk, 3iQ Digital Assets, M2, Ampersan, MNNC Group (now operating as Monarq Asset Management) and Trovio Asset Management as clients.
Security response and stakes
CoinDesk said the attacker exploited a vulnerability in Haruko’s infrastructure and that the access token was extracted through a vulnerability in Haruko’s infrastructure rather than by compromising clients’ own systems. In messages reviewed by CoinDesk, Haruko’s co-founder and chief technology officer Adam Carlile described the incident as "This was a targeted attack by a group on us," and he said "It was 15 clients impacted." CoinDesk reported that Haruko plans to publish a full technical post-mortem and that it serves more than 80 clients globally while connecting with over 100 centralized trading venues, 30 blockchains and 250 onchain protocols.
Altcoin Buzz added that Haruko has fixed the vulnerability and refreshed its server-side secrets, and it said Haruko told clients to enable inbound IP whitelisting for what the firm calls maximum protection. Across the broader market, CoinDesk cited TRM Labs figures that infrastructure and operational compromises accounted for about 76% of the money stolen despite representing only 15% of incidents, while CertiK estimated first-half losses at $1.32 billion across 344 incidents.