Haruko Cyberattack Exposes Risks in Crypto Infrastructure After 15 Clients Hit

Crypto technology provider Haruko has disclosed that it was targeted in a cyberattack that affected 15 clients, with some smaller hedge-fund customers reportedly losing a small amount of money. The incident has raised fresh concerns about the security of institutional crypto infrastructure, especially at firms that sit between exchanges and trading clients.

According to reporting on the incident, attackers exploited a vulnerability inside Haruko’s systems to extract user access tokens from process memory, which then exposed read-only exchange API details and trading data belonging to affected clients. Haruko co-founder and CTO Adam Carlile told customers that the attack was specifically aimed at Haruko itself, not at the clients’ own systems.

The company said client login credentials were not compromised on the customers’ side, but the breach still appears to have been serious enough to let attackers access sensitive trading information and, in some cases, move funds. Sources familiar with the matter said the financial losses were limited and affected mainly smaller hedge funds with weaker security controls.

Haruko has reportedly patched the vulnerability and rotated its server-side secrets after the attack. The firm is also expected to publish a more detailed technical post-incident report, which may shed light on how the compromise unfolded and what defenses failed.

The breach underscores a growing problem in crypto markets: even when exchanges and trading firms harden their own systems, third-party infrastructure providers can become single points of failure. Haruko’s role as an institutional technology provider made the incident especially sensitive because its tools connect clients to multiple exchanges and handle trading-related data that can be exploited if exposed.

The company has also urged customers to strengthen their own security practices, including the use of inbound IP whitelisting, which can restrict access to approved internet addresses. That advice suggests Haruko believes some affected accounts may not have had enough defensive controls in place to limit the blast radius of the attack.

The incident adds to a year of persistent cyber pressure across the crypto sector, where attackers continue to target exchanges, custody providers, and supporting software vendors alike. For institutions that depend on outside technology stacks, Haruko’s breach is another reminder that operational security now extends far beyond the exchange login screen.

Disclaimers: All contents in this article are for informational purposes only and does not constitute any form of advice.Third-party websites and their content are provided for informational purposes and user convenience only. Rola News does not control, endorse, or assume responsibility for any Third-party websites, including their content, accuracy, privacy practices, or any subsequent changes or updates made to them. This article is AI-assisted and has been reviewed by our editorial team.