Leaderboard
95All-time rank
IF
IRA Financial / Gemini
Feb 12, 2022
$36.0M
Lost
$36.0M
Recovered
$0
Net loss
$36.0M
Unrecovered0% recovered
Hackers obtained IRA Financial's master API key from unencrypted emails between Gemini and IRA, which contained a single point of failure that bypassed security protocols. The attackers consolidated funds from all sub-accounts into one and withdrew approximately $36M in Bitcoin and Ether within a two-hour window before Gemini could freeze accounts.
- Target
- CEX
- Classification
- Frontend & Infrastructure
- Technique
- API Key Compromised
- Attribution
- Unknown
- Chains
Ethereum
Event timeline
- Feb 12, 2022Exploit executed — $36.0M drained via api key compromised
- Attributed to Unknown
- Recovery status Unrecovered 0%