London crypto infrastructure provider Haruko told clients a targeted cyberattack hit its own systems and impacted 15 customers — specifically those that had not configured inbound IP whitelisting. Attackers exploited a vulnerability in a Haruko process, extracted a user access token, and captured data from process memory that could include read-only exchange API details and trading records. CoinDesk reviewed CTO Adam Carlile’s client messages and published the account on September 18, 2026.
This is a verified Haruko incident via company client communications reported by CoinDesk — not an anonymous forum dump. Canonical record: https://breachhistory.com/haruko/haruko-api2026. Primary: CoinDesk.
What happened
Haruko sells portfolio, risk, and trade-data tooling that connects institutional clients to centralized exchanges, custodians, blockchains, and DeFi protocols. The attacker did not need to phish each hedge fund’s laptop. A vulnerability in Haruko’s process memory path, plus a stolen access token, was enough to pull client-linked API material for fifteen non-whitelisted accounts.
People familiar with the matter told CoinDesk a small amount of client funds was also stolen. The amount and exact withdrawal path were not disclosed. That detail matters because the company described the exposed exchange credentials as read-only — a configuration that normally cannot move assets. Either additional permissions existed somewhere, or a separate path was used. Public reporting has not closed that gap.
Timeline
- Week of September 15, 2026 (approx.): Targeted attack on Haruko infrastructure.
- September 18: CoinDesk publishes CTO messages describing 15 impacted clients, token theft from process memory, remediation, and whitelist guidance.
- Same day updates: GSR and 3iQ publicly said they were not impacted; both cite whitelist / no exposure.
How the attack worked
Carlile told clients the attacker exploited a vulnerability in one of Haruko’s processes, extracted a user access token, and used it to capture data held in process memory. That memory could include read-only exchange API details and other trading data. Client login credentials stored on clients’ own systems were not compromised, per the company messages.
One source told CoinDesk the breach was possible in part because Haruko runs on bare-metal servers rather than a major cloud with additional default controls. That is an architectural note, not a complete root-cause analysis. Haruko said it fixed the vulnerability, rotated server-side secrets, and plans a full technical post-mortem.
The decisive control the company pushed afterward: inbound IP whitelisting. All 15 affected parties had not enabled it. 3iQ’s public comment underlined that its API access is restricted through IP whitelisting.
What was exposed
Confirmed in company messaging: read-only exchange API details and trading data for 15 clients. Confirmed not exposed (per Haruko): client-system login credentials. Reported by sources, not quantified: a small amount of client funds stolen. Client names among the 15 were not published. Public website references include Bitcoin Suisse, GSR, Flowdesk, 3iQ, M2, Ampersan, Monarq (ex-MNNC), and Trovio — several of which either denied impact or did not comment.
Who is at risk
Non-whitelisted Haruko clients — rotate exchange API keys, review trade logs, and enable IP allowlists immediately.
Whitelisted clients — still verify no anomalous sessions; GSR/3iQ-style public denials are firm-specific, not universal.
Peer crypto infra vendors — process-memory token theft is a design smell worth tabletopping this quarter.
Industry context
TRM Labs counted 207 crypto hacks in H1 2026 with about $972 million stolen; infrastructure and operational compromises drove most of the dollar losses despite being a minority of incident counts. Haruko sits in that high-impact category: one vendor compromise fans out across many funds.
What Haruko said
“This was a targeted attack by a group on us… 15 clients were impacted.” Fixed vulnerability; refreshed server-side secrets; configure inbound IP whitelist for maximum protection; post-mortem forthcoming. Haruko did not respond to CoinDesk’s media requests for on-record comment beyond the client messages.
Was I affected?
If you are a Haruko client without IP whitelisting during mid-September 2026, treat yourself as in the blast radius until Haruko says otherwise. If your fund already enforced allowlists and received a clean bill, still rotate keys as hygiene.
What you should do
- Enable inbound IP whitelisting on Haruko and on every exchange API key.
- Rotate all exchange API keys that ever touched Haruko integrations.
- Audit trade and withdrawal logs for mid-September anomalies.
- Confirm API keys are truly read-only — then still rotate them.
- Move signing / withdrawal authority off any shared infra you do not control.
- Require hardware-backed approvals for withdrawals.
- Preserve logs if you may need insurance or law-enforcement support.
- Ask Haruko for written scope: which keys, which venues, which dates.
- Do not reuse the same API secret across venues.
- Peer funds: tabletop a vendor process-memory token theft this month.
Canonical record and sources
Evidence-folder note 1 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 2 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 3 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 4 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 5 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 6 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 7 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 8 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 9 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 10 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 11 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 12 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 13 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 14 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 15 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 16 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 17 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 18 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 19 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 20 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 21 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 22 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 23 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 24 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 25 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 26 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 27 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 28 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 29 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 30 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 31 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 32 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 33 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 34 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 35 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 36 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 37 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 38 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.
Evidence-folder note 39 for Haruko: store the primary notice URL, the published impact statement, and any regulator or law-enforcement references together. Brief executives from those artifacts only. Update the BreachHistory catalog when the victim revises counts, confirms data types, or issues a restoration notice.