Haruko said earlier this week it was hit by a cyberattack that affected 15 clients, exposing read-only exchange API details and trading data, while some hedge fund clients with weaker security suffered small fund losses, according to comments from co-founder and CTO Adam Carlile.

Haruko said the attackers exploited a vulnerability in its internal processes to extract user access tokens and obtain read-only exchange API information held in process memory. The company said clients’ login credentials were not compromised.

Carlile said the attack was initiated by an organization and that all affected clients were non-whitelisted. Haruko said some hedge fund clients with weaker security may have had small amounts of funds stolen, though it did not disclose the total value of losses, identify the affected firms, or specify which exchanges or accounts were involved.

The London-based firm provides portfolio, risk management, and trading data infrastructure to institutional digital asset companies. Haruko said it serves more than 80 clients globally and connects to more than 100 centralized exchanges, 30 blockchains, and 250 on-chain protocols. Its listed clients include Bitcoin Suisse, GSR, Flowdesk, 3iQ Digital Assets, and M2. GSR said it was not affected by the incident.

Haruko said it has patched the vulnerability and refreshed server-side keys. The company also said it plans to publish a comprehensive technical review. For now, several material details remain undisclosed, including the timeline of client notifications, the exact number of accounts exposed at each client, and whether any outside forensic or regulatory review is under way.

Why It Matters

The incident highlights a sensitive part of crypto market structure: the software and data providers that sit between institutional clients and trading venues. Even when exchange login credentials are not compromised, exposure of API data and token-handling weaknesses can create operational and custody risks for firms that rely on automated trading connections.

It also puts more focus on basic control design in institutional crypto operations, especially API permission limits and account whitelisting. As more professional trading firms depend on connected infrastructure across exchanges and blockchains, security failures at service providers can become a direct source of counterparty and execution risk.