Breaches and incidents
Haruko (UK): crypto infrastructure provider breach exposes 15 clients’ exchange API details, some funds lost
Per CoinDesk, co-founder and CTO Adam Carlile told clients “It was 15 clients impacted” in “a targeted attack by a group on us”.
- Disclosed
- Verification
- Reported by a reputable outlet, citing the company
What happened
- Per CoinDesk, co-founder and CTO Adam Carlile told clients “It was 15 clients impacted” in “a targeted attack by a group on us”; read-only exchange API details and trading data were exposed and, per three anonymous sources, “a small amount of client funds was stolen.”
- Root cause per Haruko as reported: the attacker exploited a vulnerability in one of Haruko’s processes to extract a user-access token and “capture data held in the process’s memory.”
- No attacker named beyond “a group”.
- Haruko said it fixed the vulnerability, refreshed server-side secrets, advised clients that an inbound IP whitelist would give “maximum protection” and plans a technical post-mortem.