Key Takeaways
- • Haruko, a London-based crypto infrastructure provider serving institutional traders across 100+ exchanges, suffered a targeted cyberattack that exposed 15 clients' read-only exchange API credentials and trading data, with some smaller hedge funds sustaining actual financial losses despite the "read-only" classification.
- • Attackers exploited a vulnerability in Haruko's internal processes to extract user access tokens directly from process memory, bypassing login credential security and gaining visibility into client positions, trade history, and portfolio composition.
- • Haruko's infrastructure architecture—built on bare-metal servers rather than cloud providers like AWS—eliminated critical layers of access monitoring and isolation that would have constrained the attack surface between a single exploited process and tokens stored in memory.
- • Read-only API access proved insufficient as a security safeguard; even without fund-moving capabilities, exposed exchange API keys provide attackers complete intelligence on a fund's holdings, positioning, and trading patterns, creating material operational and competitive risk.
- • Smaller hedge funds with lighter internal security controls suffered quantifiable losses, though the total amount remains undisclosed, exposing a material vulnerability in third-party crypto trading platform dependencies for institutional investors.
Summary
Haruko, a London-based cryptocurrency infrastructure firm that connects institutional traders to more than 100 exchanges, confirmed this week that a targeted cyberattack compromised 15 of its clients' systems and resulted in financial losses for some smaller hedge funds. The breach fundamentally undermines a core security assumption in institutional trading infrastructure: that read-only API access provides meaningful protection against unauthorized capital movement or loss.
According to CoinDesk reporting of communications from Haruko co-founder and CTO Adam Carlile, attackers exploited a vulnerability in the company's internal processes to extract user access tokens directly from process memory. This technique bypassed traditional login credential security entirely, exposing exchange API details and complete trading records across the affected client base. Haruko stated that login credentials themselves were not compromised, but the exposure of API tokens proved sufficient for attackers to access sensitive operational data and, critically, to move funds for certain clients.
The breach's impact on smaller hedge fund clients reveals a secondary vulnerability: those firms with lighter internal security controls experienced actual capital losses—amounts that remain undisclosed. This outcome contradicts the conventional safeguard assumption that read-only API permissions create a meaningful firewall against financial loss. Read-only access, by design, should restrict visibility only; it should prevent any fund movement. Yet Haruko's clients lost money, suggesting attackers either escalated from read-only tokens to write-enabled access or exploited additional vulnerabilities in downstream exchange connections.
A critical technical factor amplified the attack's severity: Haruko's infrastructure runs on bare-metal servers—physical machines controlled directly by the company—rather than cloud infrastructure like Amazon Web Services. Cloud platforms bundle additional layers of access monitoring, process isolation, and audit controls that constrain lateral movement and token exposure in memory. By choosing bare-metal infrastructure, Haruko gained operational control but sacrificed these guardrails. A single exploited process became the only barrier between attackers and access tokens sitting in system memory.
The incident carries material implications for institutional investors using third-party crypto trading platforms. Exchange API keys, even those designated read-only, grant complete visibility into a fund's positions, portfolio composition, and trading behavior—data that competitors, surveillance actors, or adversaries can weaponize. For hedge funds, the loss of operational security around API credentials extends beyond direct fund loss to include loss of trading advantage, front-running risk, and exposure of proprietary strategies. This attack demonstrates that infrastructure architecture decisions at service providers directly determine client risk exposure, regardless of declared access permission levels.
According to CoinDesk reporting of communications from Haruko co-founder and CTO Adam Carlile, attackers exploited a vulnerability in the company's internal processes to extract user access tokens directly from process memory. This technique bypassed traditional login credential security entirely, exposing exchange API details and complete trading records across the affected client base. Haruko stated that login credentials themselves were not compromised, but the exposure of API tokens proved sufficient for attackers to access sensitive operational data and, critically, to move funds for certain clients.
The breach's impact on smaller hedge fund clients reveals a secondary vulnerability: those firms with lighter internal security controls experienced actual capital losses—amounts that remain undisclosed. This outcome contradicts the conventional safeguard assumption that read-only API permissions create a meaningful firewall against financial loss. Read-only access, by design, should restrict visibility only; it should prevent any fund movement. Yet Haruko's clients lost money, suggesting attackers either escalated from read-only tokens to write-enabled access or exploited additional vulnerabilities in downstream exchange connections.
A critical technical factor amplified the attack's severity: Haruko's infrastructure runs on bare-metal servers—physical machines controlled directly by the company—rather than cloud infrastructure like Amazon Web Services. Cloud platforms bundle additional layers of access monitoring, process isolation, and audit controls that constrain lateral movement and token exposure in memory. By choosing bare-metal infrastructure, Haruko gained operational control but sacrificed these guardrails. A single exploited process became the only barrier between attackers and access tokens sitting in system memory.
The incident carries material implications for institutional investors using third-party crypto trading platforms. Exchange API keys, even those designated read-only, grant complete visibility into a fund's positions, portfolio composition, and trading behavior—data that competitors, surveillance actors, or adversaries can weaponize. For hedge funds, the loss of operational security around API credentials extends beyond direct fund loss to include loss of trading advantage, front-running risk, and exposure of proprietary strategies. This attack demonstrates that infrastructure architecture decisions at service providers directly determine client risk exposure, regardless of declared access permission levels.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.