IRA Financial Sues Gemini for $36 Million Crypto Hack

Tor Constantino | June 23, 2022

The preliminary stages of evidentiary discovery are underway in a $36 million lawsuit between IRA Financial Trust, a leading platform for self-directed retirement and pension accounts, and cryptocurrency exchange and custodial wallet provider, Gemini Trust Company.

According to the complaint, IRA alleges that Gemini failed to provide proper safeguards to protect the crypto assets of IRA Financial clients stored on Gemini’s trading exchange. Additionally, the lawsuit asserts that Gemini failed to freeze accounts within a sufficient time frame immediately following the incident. It’s alleged that Gemini’s failure to respond quickly allowed cyber-hackers to continue siphoning funds for hours out of customers’ accounts on the Gemini exchange after IRA notified Gemini.

“IRA Financial filed this lawsuit because, contrary to Gemini’s many public statements about how it prioritizes security, Gemini’s platform inexplicably had a single point of failure that allowed criminals to steal tens of millions of dollars of crypto assets from customer retirement accounts. This lawsuit seeks to remedy the massive damage that IRA suffered. IRA looks forward to proving its claims in court,” Eric Ostroff, legal counsel for IRA, is quoted as saying in the official announcement of the suit.

Alleged single point of failure

A key element of the lawsuit is IRA Financial’s assertion that despite Gemini’s highly publicized, multi-layered approach to security, it created a “master key” for the IRA Financial account. It then purportedly tucked all IRA client accounts beneath that single key as sub-accounts, creating a solitary entry point that hackers needed to compromise — which they did.

“Critically, Gemini never informed IRA about the power of this master key. To the contrary, Gemini itself handled IRA’s master key as if it was a mundane piece of information, repeatedly exchanging unsecured, unencrypted emails with IRA containing the master key. Not only did Gemini’s system harbor a single-point-of-failure, but it also contained a sweeping vulnerability that allowed for a breach of a single customer account to metastasize across all accounts,” the complaint reads.

In a recent media report, a spokesperson for Gemini refuted the allegations and said the lawsuit is baseless, stating, “Our security standards are among the highest in the industry and we are constantly updating them to ensure our customers are always protected. In this matter as soon as IRA Financial notified us of their security incident we acted quickly to mitigate the loss of funds from their accounts,” as quoted in the media article.

The complaint goes on to state that hackers made off with tens of millions of dollars worth of Bitcoin and Ethereum respectively. IRA Financial pledges to reimburse clients with proceeds recovered from the Gemini litigation.

IRA Financial Sues Gemini for $36 Million Crypto Hack. June 23, 2022. The preliminary stages of evidentiary discovery are underway in a $36 million lawsuit between IRA Financial Trust, a leading platform for self-directed retirement and pension accounts, and cryptocurrency exchange and custodial wallet provider, Gemini Trust Company. According to the complaint, IRA alleges that Gemini failed to provide proper safeguards to protect the crypto assets of IRA Financial clients stored on Gemini’s trading exchange. Additionally, the lawsuit asserts that Gemini failed to freeze accounts within a sufficient time frame immediately following the incident. It’s alleged that Gemini’s failure to respond quickly allowed cyber-hackers to continue siphoning funds for hours out of customers’ accounts on the Gemini exchange after IRA notified Gemini. “IRA Financial filed this lawsuit because, contrary to Gemini’s many public statements about how it prioritizes security, Gemini’s platform inexplicably had a single point of failure that allowed criminals to steal tens of millions of dollars of crypto assets from customer retirement accounts. This lawsuit seeks to remedy the massive damage that IRA suffered. IRA looks forward to proving its claims in court,” Eric Ostroff, legal counsel for IRA, is quoted as saying in the official announcement of the suit. Alleged single point of failure A key element of the lawsuit is IRA Financial’s assertion that despite Gemini’s highly publicized, multi-layered approach to security, it created a “master key” for the IRA Financial account. It then purportedly tucked all IRA client accounts beneath that single key as sub-accounts, creating a solitary entry point that hackers needed to compromise — which they did. “Critically, Gemini never informed IRA about the power of this master key. To the contrary, Gemini itself handled IRA’s master key as if it was a mundane piece of information, repeatedly exchanging unsecured, unencrypted emails with IRA containing the master key. Not only did Gemini’s system harbor a single-point-of-failure, but it also contained a sweeping vulnerability that allowed for a breach of a single customer account to metastasize across all accounts,” the complaint reads. In a recent media report, a spokesperson for Gemini refuted the allegations and said the lawsuit is baseless, stating, “Our security standards are among the highest in the industry and we are constantly updating them to ensure our customers are always protected. In this matter as soon as IRA Financial notified us of their security incident we acted quickly to mitigate the loss of funds from their accounts,” as quoted in the media article. The complaint goes on to state that hackers made off with tens of millions of dollars worth of Bitcoin and Ethereum respectively. IRA Financial pledges to reimburse clients with proceeds recovered from the Gemini litigation. Read more: https://www.nasdaq.com/articles/ira-financial-sues-gemini-for-%2436-million-crypto-hack . Tor Constantino, Other NewsGemini Security Failures to Blame for Crypto Hack, IRA Suit Says, June 6, 2022, Crypto retirement provider IRA Financial sues Gemini over $37 million heist that led to customers’ accounts getting drained, June 7, 2022, IRA Financial Sues Gemini Over $37M Crypto Heist, June 7, 2022, Archive. March 2024 November 2023 April 2023 January 2023 November 2022 June 2022 May 2022 April 2022 March 2022 . MRB. Contact us, Our attorneys, careers. About. Firm overview, Our Values, Community involvement, Representative matters. Pracrtice. Real Estate, Commercial Litigation, Receiverships and Assignments, Bankruptcy and Restructuring. In the News, Announcements, Film Videos. 2018 Meland, Russin, Budwick. ALL RIGHTS RESERVED.