Crypto Infrastructure Company Attacked: 15 Clients Affected, Some Customer Funds Stolen
Fifteen institutional clients were affected and some customer funds were lost in an attack on crypto infrastructure company Haruko.
London-based Haruko provides infrastructure services that allow institutions to track their crypto portfolios, transactions, and risks. According to customer messages reviewed by CoinDesk and information provided by three people familiar with the matter, the attack occurred when the company was targeted this week.
In messages sent to clients by Haruko’s Chief Technology Officer Adam Carlile, it was stated that 15 of the company’s non-whitelisted clients were affected by the attack. Attackers exploited a vulnerability in a process within Haruko’s own infrastructure to generate a user access token and gain access to data within that process.
Security vulnerability in Haruko’s infrastructure put API and transaction data at risk
The accessed data included customers’ read-only exchange API information and transaction records. While this API information allows for data exchange with exchanges, it was reported that login credentials in the customers’ own systems were not compromised.
People familiar with the matter said that some small hedge funds may have lost assets. Anonymous sources also relayed that a small amount of customer funds was stolen.
Haruko informed clients that it has remediated the vulnerability and rotated the secret keys used on the server side. The company stated that an IP whitelist, which restricts access to only designated internet addresses, provides the highest level of protection. Additionally, it plans to publish a comprehensive technical report detailing the attack.
According to information on Haruko’s website, the company serves more than 80 clients worldwide. The platform also connects to more than 100 centralized exchanges, 30 blockchains, and 250 on-chain protocols. Bitcoin Suisse, GSR, Flowdesk, and 3iQ Digital Assets are listed among the company’s clients. GSR announced that it was not affected by the attack.
The attack occurred during a period of increasing security breaches in the crypto sector. TRM Labs reported that 207 attacks were detected in the first half of 2026 and a total of $972 million was lost in these incidents. Although infrastructure and operational vulnerabilities accounted for about 15 percent of attacks, they were responsible for approximately 76 percent of the stolen funds.