Haruko Cyberattack Exposes 15 Crypto Funds’ API Keys [2026]

A vendor almost nobody outside institutional trading desks had heard of a week ago is now the center of a live case study in third-party crypto risk. Haruko, a London-based technology provider that plugs hedge funds and asset managers into exchanges, custodians and blockchains, disclosed on September 18, 2026, that attackers had broken into its systems and pulled data tied to 15 clients. Some of those clients, according to CoinDesk’s reporting, lost actual funds.

The breach itself is small by crypto standards. No headline nine-figure number, no drained smart contract, no exchange going dark. But the mechanics matter more than the size. Haruko wasn’t holding customer coins the way an exchange does. It was the plumbing: the software that lets a fund’s dashboard talk to Binance, Coinbase, or a dozen other venues at once. When that plumbing sprang a leak, the exposure spread across every client who hadn’t locked their pipes down. That’s the story institutional crypto has been trying to avoid since Prime Trust folded in 2023, and it’s why this Haruko cyberattack is drawing outsized attention from a market that has spent the past year absorbing hard lessons on crypto wallet security from a very different corner of the industry.