Gemini Hack

Gemini, the centralized crypto exchange, said on December 14, 2022 that a third-party vendor incident had exposed customer email addresses and partial phone numbers, and that the data was being used in phishing campaigns against its users. Gemini said no account information or systems were affected and all funds and customer accounts stayed secure.

A hacker later published the dataset. Malwarebytes put the leak at just under 6 million email records, including duplicates, and Have I Been Pwned counts 5.3 million affected accounts. Have I Been Pwned says the data actually came from Twilio and affected Gemini customers who used Twilio's Authy two-factor authentication service. Twilio blamed a social engineering attack aimed at stealing employee credentials.

In March 2023, Gemini told The Block that phishing of UK and EEA customers traced back to two vendor incidents. In one, attackers obtained data directly from vendors. In the other, they tricked vendor employees into giving up login credentials. Gemini said it notified the UK and Irish data protection regulators.

Gemini advised customers to use 2FA or hardware security keys and not to treat a secret email address as protection. No Gemini funds were reported stolen. Losses by individual phishing victims, if any, are not quantified.