Crypto Tech Provider Haruko Hit by Cyberattack, 15 Clients Affected

The exposure of read-only API credentials is less severe than withdrawal-enabled keys, but it still hands attackers a map of client positions and exchange relationships — useful for targeted social engineering or front-running. That the breach is tied to bare-metal infrastructure rather than a cloud provider puts a spotlight on operational security choices at crypto vendors, where smaller funds often outsource critical infrastructure. The open question is whether affected clients face further losses beyond the initial disclosure, and whether counterparties begin demanding more transparency from third-party tech providers.