Key Takeaways
- • Haruko, a London-based crypto infrastructure provider, disclosed a targeted cyberattack affecting 15 institutional clients, exposing read-only exchange API credentials and trading data.
- • Smaller hedge-fund clients with weaker security controls suffered actual fund losses in the breach, though the primary source does not quantify total losses or affected asset values.
- • The vulnerability exploited by attackers stemmed from Haruko's use of bare-metal servers rather than cloud services like Amazon Web Services, which offer additional built-in security controls.
- • Only non-whitelisted clients were affected; the company's infrastructure used restrictive whitelisting protocols that protected a subset of its customer base from the incident.
- • Haruko patched the vulnerability and refreshed server-side secrets following the attack, though the company declined to provide detailed comment to CoinDesk.
Summary
Haruko, a crypto technology provider serving institutional clients, suffered a targeted cyberattack earlier this week that compromised 15 customers' sensitive data and exposed some clients to fund losses. The breach extracted read-only exchange API credentials and trading data belonging to the affected parties, according to messages reviewed by CoinDesk and sources familiar with the incident. The compromised API access allowed attackers to view trading activity and exchange connection details, creating downstream risk for hedge funds reliant on Haruko's infrastructure integration.
The incident disproportionately affected smaller hedge-fund clients operating with weaker internal security controls, which amplified their exposure despite the read-only nature of the exposed APIs. Three sources with direct knowledge confirmed that some of these smaller funds experienced actual asset losses following the breach. This finding contradicts a common industry assumption that read-only API access presents limited financial risk—the attackers evidently leveraged stolen credentials in conjunction with gaps in client-side security to execute unauthorized transactions.
The root cause centered on Haruko's infrastructure architecture. Rather than deploying customer-facing systems on cloud platforms such as Amazon Web Services, which enforce additional security hardening and access controls, Haruko relied on bare-metal servers—dedicated physical computers operated exclusively by the company. This infrastructure choice reduced the number of intermediate security layers available to detect and prevent unauthorized access. The attacker exploited a vulnerability within this environment to extract user access tokens, which subsequently provided entry points to clients' read-only exchange interfaces.
According to messages from Haruko co-founder and chief technology officer Adam Carlile to affected clients, only non-whitelisted customers were impacted by the breach. Whitelisting protocols restrict communications to pre-approved computers or networks; clients whose systems were whitelisted retained protection against the attack vector. This segmentation suggests Haruko maintained differential security postures across its client base—a configuration that likely reflected differing service tiers or onboarding standards.
Haruko has reported fixing the vulnerability and refreshing its server-side secrets to prevent recurrence. The company did not respond to repeated requests for detailed comment, limiting public disclosure of the full scope of remediation efforts or a comprehensive timeline of the incident. For institutional investors and hedge funds utilizing crypto infrastructure providers, the breach underscores the importance of vendor security audits, client-side API access controls, and verification that third-party service providers employ modern cloud-based security architectures rather than isolated bare-metal deployments.
The incident disproportionately affected smaller hedge-fund clients operating with weaker internal security controls, which amplified their exposure despite the read-only nature of the exposed APIs. Three sources with direct knowledge confirmed that some of these smaller funds experienced actual asset losses following the breach. This finding contradicts a common industry assumption that read-only API access presents limited financial risk—the attackers evidently leveraged stolen credentials in conjunction with gaps in client-side security to execute unauthorized transactions.
The root cause centered on Haruko's infrastructure architecture. Rather than deploying customer-facing systems on cloud platforms such as Amazon Web Services, which enforce additional security hardening and access controls, Haruko relied on bare-metal servers—dedicated physical computers operated exclusively by the company. This infrastructure choice reduced the number of intermediate security layers available to detect and prevent unauthorized access. The attacker exploited a vulnerability within this environment to extract user access tokens, which subsequently provided entry points to clients' read-only exchange interfaces.
According to messages from Haruko co-founder and chief technology officer Adam Carlile to affected clients, only non-whitelisted customers were impacted by the breach. Whitelisting protocols restrict communications to pre-approved computers or networks; clients whose systems were whitelisted retained protection against the attack vector. This segmentation suggests Haruko maintained differential security postures across its client base—a configuration that likely reflected differing service tiers or onboarding standards.
Haruko has reported fixing the vulnerability and refreshing its server-side secrets to prevent recurrence. The company did not respond to repeated requests for detailed comment, limiting public disclosure of the full scope of remediation efforts or a comprehensive timeline of the incident. For institutional investors and hedge funds utilizing crypto infrastructure providers, the breach underscores the importance of vendor security audits, client-side API access controls, and verification that third-party service providers employ modern cloud-based security architectures rather than isolated bare-metal deployments.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.