Haruko Cyberattack Exposes Exchange API Data for 15 Crypto Clients, With Some Funds Lost

A targeted cyberattack affected 15 Haruko clients and exposed read-only exchange API details and trading data, according to messages reviewed by CoinDesk and three people familiar with the incident.

Some smaller hedge-fund clients also suffered small, undisclosed losses, people familiar with the matter said.

Haruko said on Sept. 18 that it had fixed the exploited vulnerability and rotated server-side secrets. The company published its remediation announcement that day on its website.

Haruko says the exploited vulnerability has been fixed

The exposed information consisted of read-only exchange API details and trading data. Read-only permissions generally distinguish data access from the ability to place trades or withdraw assets, although the reporting does not specify the permissions or configurations involved for each affected client.

Haruko said it rotated server-side secrets alongside fixing the vulnerability. The company did not disclose further technical detail in the material cited, including how long the issue had been exploitable or when it first detected the intrusion.

Attackers accessed data through a process-memory token

Gate News reported that attackers extracted an access token by exploiting a vulnerability in a Haruko process and then read data held in process memory.

The report said the clients’ own login credentials were not compromised on their systems. In the reported account, access came through a token available through Haruko’s process rather than through theft of customer login credentials from the clients’ own environments.

Some smaller hedge-fund clients reported undisclosed losses

Some smaller hedge-fund clients lost a small amount of funds, people familiar with the incident told The Crypto Times. Neither the aggregate value of those losses nor the precise method by which funds were taken was disclosed.

Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.