IRA Financial Trust hack — February 2022

On 8 February 2022 attackers drained roughly $36 million in cryptocurrency, about $21 million in bitcoin and $15 million in ether, from customer accounts at IRA Financial Trust, a trustee that administers self-directed retirement accounts. The assets sat in sub-accounts at the exchange Gemini and belonged to individual retirement savers rather than to the firm itself.

IRA Financial's later complaint against Gemini says the account structure Gemini provided rested on a single 'master key', and that whoever held it could bypass the other protections and reach every sub-account. The suit does not explain how the attackers obtained it. Accounts were emptied one at a time over roughly two hours. On the same day police were dispatched to IRA Financial's offices in response to a false emergency call; officers later told the firm they believed the call was a ruse to occupy staff during the theft.

Gemini rejected the allegations, said its own systems were not breached, that it does not manage IRA Financial's security, and that two-factor authentication and approved-address whitelisting are mandatory for institutional clients. The suit was filed in the Southern District of New York on 6 June 2022; Judge Analisa Torres dismissed it with prejudice on 18 July 2024 after the parties reported a settlement on undisclosed terms.

The figures differ slightly. Contemporaneous reporting in February 2022, based on the firm's disclosure, put the loss at $36 million with the bitcoin and ether split; the June 2022 complaint claimed $37 million. Neither party has publicly confirmed that affected retirement savers were made whole.