- Haruko, a crypto technology provider for institutions, was hit by a targeted cyberattack that affected 15 clients.
- The incident reportedly exposed read-only exchange API details and trading data, while some smaller clients may have lost funds.
- The case is a reminder that crypto firms should limit API permissions, use IP whitelisting, and rotate sensitive access tokens quickly after any incident.
A recent CoinDesk report says London-based Haruko, a company that provides portfolio, risk-management, and trade-data tools for crypto firms, was targeted in a cyberattack earlier this week.
According to the report, the attack affected 15 clients and exposed some read-only exchange API details and trading data. An API is a connection that lets two software systems talk to each other. In crypto, APIs are often used to connect trading platforms, custodians, wallets, and reporting tools.
Read-only API access should not normally allow someone to move funds. However, CoinDesk reported that some smaller hedge-fund clients with weaker security controls may have lost a limited amount of assets. The article said the issue came from Haruko’s infrastructure rather than from clients’ own login systems.
Haruko reportedly told clients that it fixed the vulnerability and refreshed its server-side secrets. The company also advised clients to use inbound IP whitelisting, which means only approved internet addresses can connect to a service.
For crypto teams, the main lesson is simple: API access should be treated as sensitive even when it is marked read-only. Firms should keep permissions narrow, review which systems can connect, rotate keys after security events, and monitor unusual account activity.
The incident also shows why infrastructure security matters across the digital-asset market. Many crypto businesses rely on connected tools to track balances, trades, and risk. If one trusted provider is attacked, the impact can spread to multiple clients quickly.
This article is for general information only and is not financial advice.
