Haruko, a prominent London-based technology firm that provides institutional-grade infrastructure for digital asset management, has confirmed it was the target of a sophisticated cyberattack earlier this week. The security breach, which the company says affected 15 of its clients, has led to concerns regarding the safety of funds held by institutional players in the crypto space. According to three people familiar with the matter, some smaller hedge-fund clients may have suffered direct asset losses as a result of the intrusion.
The breach primarily compromised read-only exchange application programming interface (API) details and proprietary trading data. APIs serve as the critical digital bridges allowing a client’s internal systems to communicate seamlessly with Haruko’s platform, which aggregates data from centralized exchanges, custodians, various blockchains, and decentralized finance (DeFi) protocols. By compromising these channels, the attackers gained unauthorized access to the operational environment that Haruko uses to manage and monitor client positions, transactions, and risk exposure.
A Targeted Infiltration of Infrastructure
The nature of the attack appears to have been highly focused. Adam Carlile, co-founder and chief technology officer at Haruko, confirmed in internal communications seen by industry observers that the incident was a targeted effort directed specifically at the firm’s own infrastructure rather than at any singular, isolated client.
According to technical details shared by the company, the attackers successfully exploited a vulnerability within one of Haruko’s internal processes. By extracting a user-access token, the perpetrators were able to capture sensitive data held within the system’s memory. This memory dump reportedly included the read-only exchange API credentials, which are vital for the automated trading and data-tracking services Haruko provides.
Industry experts suggest that the vulnerability may be tied to Haruko’s specific architecture. Unlike many modern financial technology firms that utilize the scalable, managed security environments of cloud providers like Amazon Web Services (AWS), Haruko relies on bare-metal servers—physical hardware dedicated exclusively to the firm. While bare-metal configurations can offer performance advantages, they also place the entire burden of security, patching, and intrusion detection on the company’s internal IT team, lacking some of the automated, built-in security layers found in cloud-native environments.
Scope of the Impact and Client Responses
Haruko, which provides services to a diverse roster of institutional players, does not publicly disclose its entire client list. However, its website highlights relationships with major industry entities including Bitcoin Suisse, GSR, Flowdesk, 3iQ Digital Assets, M2, Ampersan, MNNC Group (now operating as Monarq Asset Management), and Trovio Asset Management.
The impact of the breach was not uniform across this client base. According to messages from Carlile, the incident specifically affected the firm’s "non-whitelisted" clients. In the context of cybersecurity, whitelisting is a restrictive practice that ensures only pre-approved IP addresses or specific, trusted computers can establish a connection with a server. Clients who had not implemented this additional layer of security were left significantly more exposed when the breach occurred.
Several of Haruko’s high-profile clients have moved quickly to distance themselves from the incident or clarify their security posture. A spokesperson for GSR stated, "GSR has not been impacted by any rumored breach." Similarly, a representative from 3iQ Digital Assets provided a reassuring statement, noting: "3iQ was not affected by this breach. Our funds remain fully secure, and our API access is restricted through IP whitelisting, preventing any exposure to the compromised environment."
Other firms, including Bitcoin Suisse, Flowdesk, M2, Ampersan, MNNC, and Trovio, did not respond to requests for comment regarding their status. The uncertainty surrounding these firms, coupled with the fact that Haruko has not responded to repeated media inquiries, has left a vacuum of information that has fueled anxiety among market participants.
Vulnerabilities in the Institutional Crypto Space
The theft of client funds—though described by sources as a "small amount"—highlights a persistent and systemic challenge for the cryptocurrency sector. Unlike traditional banking, where transactions can often be reversed or investigated through central clearing houses, digital asset transfers are frequently irreversible. This reality makes the security of API keys and signing systems paramount; if an attacker obtains the right digital credentials, they can often facilitate unauthorized movements of assets that are difficult, if not impossible, to claw back.
Sources familiar with the investigation suggested that the vulnerability particularly affected smaller hedge funds. These entities often have fewer resources to dedicate to robust internal security controls compared to their larger, more established counterparts. For these smaller firms, relying on third-party infrastructure providers like Haruko is a necessity for scalability, but the incident serves as a stark reminder of the "single point of failure" risk that arises when institutional infrastructure is compromised.
Haruko has stated that it has successfully patched the identified vulnerability and has taken the precaution of refreshing all server-side secrets. The firm has advised its clients that the most effective path forward for security is the immediate configuration of inbound IP whitelisting. By strictly limiting access to pre-defined, trusted internet addresses, the company aims to provide "maximum protection" against future unauthorized access. The firm has also committed to releasing a full technical post-mortem, which will be closely scrutinized by institutional investors and security auditors alike.
The Growing Threat Landscape
The attack on Haruko occurs against a backdrop of increasing hostility in the digital asset ecosystem. According to data from the blockchain intelligence firm TRM Labs, the first half of 2026 saw a record 207 individual attacks on crypto entities—a significant spike compared to the 83 incidents recorded during the same period in the previous year. While the total volume of stolen funds has fluctuated, the frequency of these attacks suggests that malicious actors are becoming more professionalized, focusing their efforts on the "plumbing" of the industry.
TRM Labs research indicates that infrastructure and operational compromises, such as the one experienced by Haruko, accounted for approximately 76% of all stolen capital in the first half of 2026, despite representing only 15% of the total number of incidents. This suggests that while large-scale, high-profile exchange hacks remain a concern, the most dangerous threats are often those targeting the middleware and service providers that act as the backbone of institutional trading.
Security firm CertiK, which tracks incidents through a broader lens, has estimated the total losses for the first half of 2026 at approximately $1.32 billion across 344 distinct incidents. As the sector continues to bridge the gap between traditional finance and decentralized protocols, the reliance on service providers like Haruko will only grow. The ability of these firms to maintain high-security standards will remain a critical factor in the maturation and long-term viability of the institutional crypto market.
For now, the 15 clients affected by the Haruko breach are left to assess the damage and reinforce their internal defenses, while the broader industry waits for the promised technical breakdown that may provide lessons on how to prevent such infrastructure-level failures in the future.
