London-based Haruko, which provides portfolio, risk-management and trade-data infrastructure for institutional digital-asset firms, was hit by a targeted cyberattack. According to CoinDesk, the incident affected 15 clients, and some smaller hedge funds with weaker security controls may have lost a limited amount of funds.
The breach exposed clients’ read-only exchange API details and trading data. CoinDesk, citing people familiar with the matter and messages sent to clients, said all affected parties were Haruko customers that did not use a whitelist, a control that limits communication to pre-approved computers or websites.
In messages reviewed by CoinDesk, Haruko co-founder and chief technology officer Adam Carlile told clients the attack was aimed at Haruko itself rather than any specific customer. He said the attacker exploited a vulnerability in one of the company’s processes, extracted a user-access token and used it to capture data held in that process’s memory. That memory may have contained read-only exchange API details and other information.
According to Carlile’s messages, clients’ login credentials stored on their own systems were not compromised. Instead, the weakness was in Haruko’s infrastructure. The company said it had fixed the vulnerability and refreshed its server-side secrets. It also advised clients to configure an inbound IP whitelist for what it described as “maximum protection.” Haruko said it plans to publish a full technical post-mortem.
Haruko does not disclose its full customer list, but its website names Bitcoin Suisse, GSR, Flowdesk, 3iQ Digital Assets, M2, Ampersan, MNNC Group (now operating as Monarq Asset Management) and Trovio Asset Management as clients. GSR said it had not been affected by any rumored breach. A representative for 3iQ Digital Assets said the firm was not impacted, its funds remained fully secure, and its API access is restricted through IP whitelisting. Bitcoin Suisse, Flowdesk, M2, Ampersan, MNNC and Trovio had not responded to requests for comment by publication time.
Sources said a small amount of client funds was stolen, along with trading data. One of the people familiar with the matter said the breach was possible because Haruko relies on bare-metal servers — physical machines used exclusively by the company — rather than cloud services such as Amazon Web Services, which offer additional security controls.
The incident comes as attacks on crypto companies are rising. TRM Labs said hackers carried out a record 207 attacks in the first half of 2026, up from 83 a year earlier, resulting in $972 million in losses. According to TRM, infrastructure and operational compromises accounted for about 76% of the money stolen despite making up only 15% of incidents. Security firm CertiK, which uses a broader definition, estimated first-half losses at $1.32 billion across 344 incidents.
