Haruko Breach Exposes API Keys of 15 Crypto Funds

A London-based technology provider called Haruko has disclosed that attackers broke into its systems and pulled data tied to 15 clients. The breach occurred on September 18, 2026. According to CoinDesk's reporting, the attack exposed clients' read-only exchange API details and trading data.

Haruko sells a consolidated view of institutional crypto activity, including portfolio tracking, risk management, and trade-data infrastructure that connects to exchanges, custodians, blockchains, and DeFi protocols. The firm links more than 80 clients to over 100 centralized trading venues, 30 blockchains, and 250 onchain protocols.

The technical detail that separates this from a generic phishing story is where the attacker actually got in. Per Carlile's account to clients, the attacker exploited a vulnerability in one of Haruko's own processes and extracted a user-access token directly from that process's memory.