← Harukoreviewed 2026-11-02 · 10 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Haruko against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
2 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #2[disputed][awaiting moderator]in section: Financial Impact and Client Exposure
“A small but confirmed amount of client funds was stolen in the incident.”
reviewerA small but confirmed amount of client funds was stolen.Sources describe the loss as reported, not confirmed. The word 'confirmed' is not supported. The same overstatement appears in the summary and timeline[2].Proposed correction (not yet applied)According to sources cited by CoinDesk, a small amount of client funds was stolen in the incident. - #3[disputed][awaiting moderator]in the timeline
“A small but confirmed amount of client funds was stolen.”
reviewerTimeline entry states funds loss as confirmed.Same defect as in sections[4].Proposed correction (not yet applied)According to sources, a small amount of client funds was stolen.
unverifiable
3 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #5[unverifiable][awaiting moderator]in section: Company Overview
“Haruko is a London-based digital asset technology platform incorporated in March 2021.”
reviewerHaruko founded 2021, incorporated March 2021, London-based.Year 2021 is confirmed. The March date was not found in fetched sources. The timeline entry cites Crypto Briefing for 2021-03-01, which was not checked, and CoinDesk does not state a founding date.citedwww.haruko.io/ - #9[unverifiable][awaiting moderator]in section: Remediation and Company Response
“TRM Labs reported that attackers carried out 207 crypto hacks in the first half of 2026, a record for any six-month period”
reviewerTRM Labs H1 2026: 207 hacks, about $972M lost, vs $2.3B a year earlier; infrastructure compromises about 15% of incidents and 76% of losses.I did not fetch the TRM page, so the figures are unchecked. The title matches the claim's direction (record count, losses under $1B). - #10[unverifiable][awaiting moderator]in section: Industry Context
“No enforcement actions, court filings, or regulatory findings against Haruko have been identified in available records.”
reviewerNo FCA inquiry announced; regulatory status unconfirmed.A negative claim. My searches found no regulatory action, but I did not search the FCA register or fetch Crypto Briefing.
partially supported
2 claimsThe cited evidence supports part of the claim but not all of it.
- #1[partially supported][awaiting moderator]in the summary
“In September 2026, the company confirmed a targeted cyberattack affecting 15 institutional clients, in which attackers exploited a server-side process vulnerability to extract access tokens and gain read-only API access to client data; a small but confirmed amount of client funds was stolen.”
reviewerThe cyberattack affected 15 institutional clients, who were non-whitelisted; attacker extracted a user-access token; funds stolen; patch and secrets rotated; post-mortem promised.Core facts hold. 'Confirmed' overstates the funds loss, which CoinDesk attributes to sources rather than a company statement. - #4[partially supported][awaiting moderator]in section: Infrastructure Risk: Bare-Metal Servers
“Multiple reports noted that Haruko operates on bare-metal servers”
reviewerHaruko operates on bare-metal servers and cloud security controls such as process isolation, managed secret storage and hardware memory protection were absent; reported by multiple outlets.CoinDesk attributes the point to a single source, not multiple reports. The detailed list of controls was not verified.
confirmed
3 claimsThe cited evidence supports the claim as written.
- #6[confirmed][no action needed]in section: Funding and Investors
“Its most recent disclosed round was a $6 million Series A announced on July 15, 2024, co-led by White Star Capital's Digital Asset Fund and MMC Ventures.”
reviewer$6M Series A on 2024-07-15, co-led by White Star Capital Digital Asset Fund and MMC Ventures, total about $16M, Singapore office, over 50 institutions.Matches the Tech.eu article. - #7[confirmed][no action needed]in section: Company Overview
“Named clients listed on Haruko's website include Bitcoin Suisse, GSR, Flowdesk, 3iQ Digital Assets, M2, Ampersan, MNNC Group (now Monarq Asset Management), and Trovio Asset Management.”
reviewerClient base over 80, 100+ venues, 30 blockchains, 250 protocols, named clients.Matches CoinDesk.citedwww.haruko.io/ - #8[confirmed][no action needed]in section: September 2026 Cyberattack
“The company committed to releasing a full technical post-mortem, though that report had not been published as of the date of initial reporting (September 18, 2026).”
reviewerPost-mortem not published as of the initial reporting date (Sept 18, 2026).Accurate as dated, but the page does not mention that it was still unpublished in early October.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.