IRA Financial Suspicious Withdrawals - Revision history

Azoundria at 18:01, 14 May 2024

2024-05-14T18:01:57Z

← Older revision		Revision as of 12:01, 14 May 2024
Line 3:		Line 3:
	[[File:Irafinancial.jpg\|thumb\|IRA Financial Homepage, CEO, Logo]]IRA Financial offers the ability for clients to invest in bitcoin and ethereum, which is stored in the third party custodian Gemini. In a single day, $36m worth of client funds were transferred between accounts and withdrawn from the Gemini platform. These funds were then mixed. Unsurprisingly, insurance is not covering anything. At present, it appears that many client accounts are still locked and there is no note of any recovery for those affected.		[[File:Irafinancial.jpg\|thumb\|IRA Financial Homepage, CEO, Logo]]IRA Financial offers the ability for clients to invest in bitcoin and ethereum, which is stored in the third party custodian Gemini. In a single day, $36m worth of client funds were transferred between accounts and withdrawn from the Gemini platform. These funds were then mixed. Unsurprisingly, insurance is not covering anything. At present, it appears that many client accounts are still locked and there is no note of any recovery for those affected.

	This exchange or platform is based in United States, or the incident targeted people primarily in United States.<ref name="theirafinancialtwitter-7070" /><ref name="theirafinancialtwitter-7072" /><ref name="theirafinancialtwitter-7074" /><ref name="yahoofinance-7075" /><ref name="yahoofinance-7081" /><ref name="carnegieendowment-9983" />		This exchange or platform is based in United States, or the incident targeted people primarily in United States.<ref name="theirafinancialtwitter-7070" /><ref name="theirafinancialtwitter-7072" /><ref name="theirafinancialtwitter-7074" /><ref name="yahoofinance-7075" /><ref name="yahoofinance-7081" /><ref name="bloomberglawnews-7079" /><ref name="carnegieendowment-9983" />

	== About IRA Financial ==		== About IRA Financial ==

Azoundria at 17:44, 14 May 2024

2024-05-14T17:44:16Z

← Older revision		Revision as of 11:44, 14 May 2024
Line 36:		Line 36:
	in a recent cyber attack, hackers stole $37 million worth of Bitcoin and Ethereum from IRA Financial, a company offering self-directed retirement accounts linked to the Gemini crypto exchange platform. The hack occurred on February 8, and while the Gemini exchange stated that it was not hacked, it pointed out that the attack was against IRA Financial. The hackers drained $21 million in Bitcoin and $50 million in Ethereum from IRA Financial Trust customers. The incident is currently under investigation, and IRA Financial has engaged third-party forensic experts and law enforcement to address the situation. Users affected by the hack reported their accounts being linked to Gemini and having funds transferred to unauthorized recipients. The importance of storing cryptocurrency securely in cold storage or using other secure methods was highlighted, and users were urged to take precautions to protect their holdings<ref name="youtube-7126" />.		in a recent cyber attack, hackers stole $37 million worth of Bitcoin and Ethereum from IRA Financial, a company offering self-directed retirement accounts linked to the Gemini crypto exchange platform. The hack occurred on February 8, and while the Gemini exchange stated that it was not hacked, it pointed out that the attack was against IRA Financial. The hackers drained $21 million in Bitcoin and $50 million in Ethereum from IRA Financial Trust customers. The incident is currently under investigation, and IRA Financial has engaged third-party forensic experts and law enforcement to address the situation. Users affected by the hack reported their accounts being linked to Gemini and having funds transferred to unauthorized recipients. The importance of storing cryptocurrency securely in cold storage or using other secure methods was highlighted, and users were urged to take precautions to protect their holdings<ref name="youtube-7126" />.

	There is a history of insurance not paying out in the event of breaches<ref name="csoonline-9981">.		There is a history of insurance not paying out in the event of breaches<ref name="csoonline-9981" />.

	== What Happened ==		== What Happened ==

Azoundria at 17:30, 14 May 2024

2024-05-14T17:30:15Z

← Older revision		Revision as of 11:30, 14 May 2024
Line 35:		Line 35:
	* Details of what audits reported and how vulnerabilities were missed during auditing.		* Details of what audits reported and how vulnerabilities were missed during auditing.
	in a recent cyber attack, hackers stole $37 million worth of Bitcoin and Ethereum from IRA Financial, a company offering self-directed retirement accounts linked to the Gemini crypto exchange platform. The hack occurred on February 8, and while the Gemini exchange stated that it was not hacked, it pointed out that the attack was against IRA Financial. The hackers drained $21 million in Bitcoin and $50 million in Ethereum from IRA Financial Trust customers. The incident is currently under investigation, and IRA Financial has engaged third-party forensic experts and law enforcement to address the situation. Users affected by the hack reported their accounts being linked to Gemini and having funds transferred to unauthorized recipients. The importance of storing cryptocurrency securely in cold storage or using other secure methods was highlighted, and users were urged to take precautions to protect their holdings<ref name="youtube-7126" />.		in a recent cyber attack, hackers stole $37 million worth of Bitcoin and Ethereum from IRA Financial, a company offering self-directed retirement accounts linked to the Gemini crypto exchange platform. The hack occurred on February 8, and while the Gemini exchange stated that it was not hacked, it pointed out that the attack was against IRA Financial. The hackers drained $21 million in Bitcoin and $50 million in Ethereum from IRA Financial Trust customers. The incident is currently under investigation, and IRA Financial has engaged third-party forensic experts and law enforcement to address the situation. Users affected by the hack reported their accounts being linked to Gemini and having funds transferred to unauthorized recipients. The importance of storing cryptocurrency securely in cold storage or using other secure methods was highlighted, and users were urged to take precautions to protect their holdings<ref name="youtube-7126" />.

			There is a history of insurance not paying out in the event of breaches<ref name="csoonline-9981">.

	== What Happened ==		== What Happened ==
Line 164:		Line 166:
	“We are working closely with third-party forensic specialists to determine the nature and scope of this incident,” a spokesperson from IRA Financial’s hired crisis communications firm told CoinDesk.		“We are working closely with third-party forensic specialists to determine the nature and scope of this incident,” a spokesperson from IRA Financial’s hired crisis communications firm told CoinDesk.

	<ref name="~~slowmist~~-2069" />		<ref name="slowmisthacked-2069" />

	=== IRA Financial Posts/Media Deleted ===		=== IRA Financial Posts/Media Deleted ===
Line 218:		Line 220:
	== References ==		== References ==
	<references>		<references>
	<ref name="~~slowmist~~-2069">[https://hacked.slowmist.io/en/ SlowMist Hacked - SlowMist Zone] (Jun 26, 2021)</ref>		<ref name="slowmisthacked-2069">[https://hacked.slowmist.io/en/ SlowMist Hacked - SlowMist Zone] (Jun 26, 2021)</ref>
	<ref name="irafinancial-7067">[https://www.irafinancial.com/ Home - IRA Financial] (Mar 12, 2022)</ref>		<ref name="irafinancial-7067">[https://www.irafinancial.com/ Home - IRA Financial] (Mar 12, 2022)</ref>
	<ref name="prweb-7068">[https://www.prweb.com/releases/ira_financial_launches_new_digital_solution_for_using_ira_funds_to_buy_bitcoin_directly_from_cryptocurrency_exchange_and_custodian_gemini/prweb16734494.htm IRA Financial Launches New Digital Solution for Using IRA Funds to Buy Bitcoin Directly from Cryptocurrency Exchange and Custodian Gemini] (Mar 12, 2022)</ref>		<ref name="prweb-7068">[https://www.prweb.com/releases/ira_financial_launches_new_digital_solution_for_using_ira_funds_to_buy_bitcoin_directly_from_cryptocurrency_exchange_and_custodian_gemini/prweb16734494.htm IRA Financial Launches New Digital Solution for Using IRA Funds to Buy Bitcoin Directly from Cryptocurrency Exchange and Custodian Gemini] (Mar 12, 2022)</ref>

Azoundria at 17:12, 14 May 2024

2024-05-14T17:12:59Z

← Older revision		Revision as of 11:12, 14 May 2024
Line 35:		Line 35:
	* Details of what audits reported and how vulnerabilities were missed during auditing.		* Details of what audits reported and how vulnerabilities were missed during auditing.
	in a recent cyber attack, hackers stole $37 million worth of Bitcoin and Ethereum from IRA Financial, a company offering self-directed retirement accounts linked to the Gemini crypto exchange platform. The hack occurred on February 8, and while the Gemini exchange stated that it was not hacked, it pointed out that the attack was against IRA Financial. The hackers drained $21 million in Bitcoin and $50 million in Ethereum from IRA Financial Trust customers. The incident is currently under investigation, and IRA Financial has engaged third-party forensic experts and law enforcement to address the situation. Users affected by the hack reported their accounts being linked to Gemini and having funds transferred to unauthorized recipients. The importance of storing cryptocurrency securely in cold storage or using other secure methods was highlighted, and users were urged to take precautions to protect their holdings<ref name="youtube-7126" />.		in a recent cyber attack, hackers stole $37 million worth of Bitcoin and Ethereum from IRA Financial, a company offering self-directed retirement accounts linked to the Gemini crypto exchange platform. The hack occurred on February 8, and while the Gemini exchange stated that it was not hacked, it pointed out that the attack was against IRA Financial. The hackers drained $21 million in Bitcoin and $50 million in Ethereum from IRA Financial Trust customers. The incident is currently under investigation, and IRA Financial has engaged third-party forensic experts and law enforcement to address the situation. Users affected by the hack reported their accounts being linked to Gemini and having funds transferred to unauthorized recipients. The importance of storing cryptocurrency securely in cold storage or using other secure methods was highlighted, and users were urged to take precautions to protect their holdings<ref name="youtube-7126" />.

	~~There is a history if insurance not paying out in the event of breaches<ref name="csoonline-9981">.~~

	== What Happened ==		== What Happened ==
Line 166:		Line 164:
	“We are working closely with third-party forensic specialists to determine the nature and scope of this incident,” a spokesperson from IRA Financial’s hired crisis communications firm told CoinDesk.		“We are working closely with third-party forensic specialists to determine the nature and scope of this incident,” a spokesperson from IRA Financial’s hired crisis communications firm told CoinDesk.

	<ref name="~~slowmisthacked~~-2069" />		<ref name="slowmist-2069" />

	=== IRA Financial Posts/Media Deleted ===		=== IRA Financial Posts/Media Deleted ===
Line 220:		Line 218:
	== References ==		== References ==
	<references>		<references>
	<ref name="~~slowmisthacked~~-2069">[https://hacked.slowmist.io/en/ SlowMist Hacked - SlowMist Zone] (Jun 26, 2021)</ref>		<ref name="slowmist-2069">[https://hacked.slowmist.io/en/ SlowMist Hacked - SlowMist Zone] (Jun 26, 2021)</ref>
	<ref name="irafinancial-7067">[https://www.irafinancial.com/ Home - IRA Financial] (Mar 12, 2022)</ref>		<ref name="irafinancial-7067">[https://www.irafinancial.com/ Home - IRA Financial] (Mar 12, 2022)</ref>
	<ref name="prweb-7068">[https://www.prweb.com/releases/ira_financial_launches_new_digital_solution_for_using_ira_funds_to_buy_bitcoin_directly_from_cryptocurrency_exchange_and_custodian_gemini/prweb16734494.htm IRA Financial Launches New Digital Solution for Using IRA Funds to Buy Bitcoin Directly from Cryptocurrency Exchange and Custodian Gemini] (Mar 12, 2022)</ref>		<ref name="prweb-7068">[https://www.prweb.com/releases/ira_financial_launches_new_digital_solution_for_using_ira_funds_to_buy_bitcoin_directly_from_cryptocurrency_exchange_and_custodian_gemini/prweb16734494.htm IRA Financial Launches New Digital Solution for Using IRA Funds to Buy Bitcoin Directly from Cryptocurrency Exchange and Custodian Gemini] (Mar 12, 2022)</ref>

Azoundria at 17:05, 14 May 2024

2024-05-14T17:05:45Z

← Older revision		Revision as of 11:05, 14 May 2024
Line 3:		Line 3:
	[[File:Irafinancial.jpg\|thumb\|IRA Financial Homepage, CEO, Logo]]IRA Financial offers the ability for clients to invest in bitcoin and ethereum, which is stored in the third party custodian Gemini. In a single day, $36m worth of client funds were transferred between accounts and withdrawn from the Gemini platform. These funds were then mixed. Unsurprisingly, insurance is not covering anything. At present, it appears that many client accounts are still locked and there is no note of any recovery for those affected.		[[File:Irafinancial.jpg\|thumb\|IRA Financial Homepage, CEO, Logo]]IRA Financial offers the ability for clients to invest in bitcoin and ethereum, which is stored in the third party custodian Gemini. In a single day, $36m worth of client funds were transferred between accounts and withdrawn from the Gemini platform. These funds were then mixed. Unsurprisingly, insurance is not covering anything. At present, it appears that many client accounts are still locked and there is no note of any recovery for those affected.

	This exchange or platform is based in United States, or the incident targeted people primarily in United States.<ref name="theirafinancialtwitter-7070" /><ref name="theirafinancialtwitter-7072" /><ref name="theirafinancialtwitter-7074" /><ref name="yahoofinance-7075" /><ref name="yahoofinance-7081" />		This exchange or platform is based in United States, or the incident targeted people primarily in United States.<ref name="theirafinancialtwitter-7070" /><ref name="theirafinancialtwitter-7072" /><ref name="theirafinancialtwitter-7074" /><ref name="yahoofinance-7075" /><ref name="yahoofinance-7081" /><ref name="carnegieendowment-9983" />

	== About IRA Financial ==		== About IRA Financial ==
Line 35:		Line 35:
	* Details of what audits reported and how vulnerabilities were missed during auditing.		* Details of what audits reported and how vulnerabilities were missed during auditing.
	in a recent cyber attack, hackers stole $37 million worth of Bitcoin and Ethereum from IRA Financial, a company offering self-directed retirement accounts linked to the Gemini crypto exchange platform. The hack occurred on February 8, and while the Gemini exchange stated that it was not hacked, it pointed out that the attack was against IRA Financial. The hackers drained $21 million in Bitcoin and $50 million in Ethereum from IRA Financial Trust customers. The incident is currently under investigation, and IRA Financial has engaged third-party forensic experts and law enforcement to address the situation. Users affected by the hack reported their accounts being linked to Gemini and having funds transferred to unauthorized recipients. The importance of storing cryptocurrency securely in cold storage or using other secure methods was highlighted, and users were urged to take precautions to protect their holdings<ref name="youtube-7126" />.		in a recent cyber attack, hackers stole $37 million worth of Bitcoin and Ethereum from IRA Financial, a company offering self-directed retirement accounts linked to the Gemini crypto exchange platform. The hack occurred on February 8, and while the Gemini exchange stated that it was not hacked, it pointed out that the attack was against IRA Financial. The hackers drained $21 million in Bitcoin and $50 million in Ethereum from IRA Financial Trust customers. The incident is currently under investigation, and IRA Financial has engaged third-party forensic experts and law enforcement to address the situation. Users affected by the hack reported their accounts being linked to Gemini and having funds transferred to unauthorized recipients. The importance of storing cryptocurrency securely in cold storage or using other secure methods was highlighted, and users were urged to take precautions to protect their holdings<ref name="youtube-7126" />.

			There is a history if insurance not paying out in the event of breaches<ref name="csoonline-9981">.

	== What Happened ==		== What Happened ==
Line 164:		Line 166:
	“We are working closely with third-party forensic specialists to determine the nature and scope of this incident,” a spokesperson from IRA Financial’s hired crisis communications firm told CoinDesk.		“We are working closely with third-party forensic specialists to determine the nature and scope of this incident,” a spokesperson from IRA Financial’s hired crisis communications firm told CoinDesk.

	<ref name="~~slowmist~~-2069" />		<ref name="slowmisthacked-2069" />

	=== IRA Financial Posts/Media Deleted ===		=== IRA Financial Posts/Media Deleted ===
Line 218:		Line 220:
	== References ==		== References ==
	<references>		<references>
	<ref name="~~slowmist~~-2069">[https://hacked.slowmist.io/en/ SlowMist Hacked - SlowMist Zone] (Jun 26, 2021)</ref>		<ref name="slowmisthacked-2069">[https://hacked.slowmist.io/en/ SlowMist Hacked - SlowMist Zone] (Jun 26, 2021)</ref>
	<ref name="irafinancial-7067">[https://www.irafinancial.com/ Home - IRA Financial] (Mar 12, 2022)</ref>		<ref name="irafinancial-7067">[https://www.irafinancial.com/ Home - IRA Financial] (Mar 12, 2022)</ref>
	<ref name="prweb-7068">[https://www.prweb.com/releases/ira_financial_launches_new_digital_solution_for_using_ira_funds_to_buy_bitcoin_directly_from_cryptocurrency_exchange_and_custodian_gemini/prweb16734494.htm IRA Financial Launches New Digital Solution for Using IRA Funds to Buy Bitcoin Directly from Cryptocurrency Exchange and Custodian Gemini] (Mar 12, 2022)</ref>		<ref name="prweb-7068">[https://www.prweb.com/releases/ira_financial_launches_new_digital_solution_for_using_ira_funds_to_buy_bitcoin_directly_from_cryptocurrency_exchange_and_custodian_gemini/prweb16734494.htm IRA Financial Launches New Digital Solution for Using IRA Funds to Buy Bitcoin Directly from Cryptocurrency Exchange and Custodian Gemini] (Mar 12, 2022)</ref>
Line 237:		Line 239:
	<ref name="youtube-7126">[https://www.youtube.com/watch?v=iIcX4je9bfk Cybersecurity News - IRA Financial Services Breach Hackers Stole $36 Million In Cryptocurrency - YouTube] (Mar 12, 2022)</ref>		<ref name="youtube-7126">[https://www.youtube.com/watch?v=iIcX4je9bfk Cybersecurity News - IRA Financial Services Breach Hackers Stole $36 Million In Cryptocurrency - YouTube] (Mar 12, 2022)</ref>
	<ref name="csoonline-9981">[https://www.csoonline.com/article/2984989/cyber-insurance-rejects-claim-after-bitpay-lost-1-8-million-in-phishing-attack.html Cyber insurance rejects claim after BitPay lost $1.8 million in phishing attack \| CSO Online] (Dec 11, 2022)</ref>		<ref name="csoonline-9981">[https://www.csoonline.com/article/2984989/cyber-insurance-rejects-claim-after-bitpay-lost-1-8-million-in-phishing-attack.html Cyber insurance rejects claim after BitPay lost $1.8 million in phishing attack \| CSO Online] (Dec 11, 2022)</ref>
			<ref name="carnegieendowment-9983">[https://carnegieendowment.org/specialprojects/protectingfinancialstability/timeline Timeline of Cyber Incidents Involving Financial Institutions - Carnegie Endowment for International Peace] (Dec 12, 2022)</ref>
	</references>		</references>

Azoundria: COMPLETE 30 Minutes. Source reviewed and included there. More sources reviewed and integrated into the case study.

2024-02-26T19:48:49Z

COMPLETE 30 Minutes. Source reviewed and included there. More sources reviewed and integrated into the case study.

Azoundria: Another 30 minutes spent. Added information from CoinDesk article and some information from the FXEmpire article. Improving various sections and removing placeholder text.

2024-01-25T19:10:30Z

Another 30 minutes spent. Added information from CoinDesk article and some information from the FXEmpire article. Improving various sections and removing placeholder text.

Show changes

Azoundria: Another 30 minutes complete. Integrated information from ErgoBTC and following the trail. Still lots more work to be done on this article.

2024-01-24T19:36:33Z

Another 30 minutes complete. Integrated information from ErgoBTC and following the trail. Still lots more work to be done on this article.

@@ Line 1: / Line 1: @@
 {{Case Study Under Construction}}{{Unattributed Sources}}
-[[File:Irafinancial.jpg|thumb|IRA Financial]]IRA Financial offers the ability for clients to invest in bitcoin and ethereum, which is stored in the third party custodian Gemini. In a single day, $36m worth of client funds were transferred between accounts and removed from the Gemini platform. These funds were then mixed. Unsurprisingly, insurance is not covering anything. At present, it appears that many client accounts are still locked and there is no note of any recovery for those affected.
+[[File:Irafinancial.jpg|thumb|IRA Financial Homepage, CEO, Logo]]IRA Financial offers the ability for clients to invest in bitcoin and ethereum, which is stored in the third party custodian Gemini. In a single day, $36m worth of client funds were transferred between accounts and removed from the Gemini platform. These funds were then mixed. Unsurprisingly, insurance is not covering anything. At present, it appears that many client accounts are still locked and there is no note of any recovery for those affected.
 This exchange or platform is based in United States, or the incident targeted people primarily in United States.
@@ Line 68: / Line 68: @@
 |February 8th, 2022
 |Main Event
-|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
+|The reported date of the hack.
 |-
 |February 11th, 2022 7:07:00 PM MST

Azoundria: Another 30 minutes complete. Prevention added and much more research.

2023-07-13T19:23:06Z

Another 30 minutes complete. Prevention added and much more research.

Show changes

Azoundria at 01:30, 6 March 2023

2023-03-06T01:30:25Z

← Older revision		Revision as of 19:30, 5 March 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/irafinancialsuspiciouswithdrawals.php}}		{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/irafinancialsuspiciouswithdrawals.php}}
			{{Unattributed Sources}}

	[[File:Irafinancial.jpg\|thumb\|IRA Financial]]IRA Financial offers the ability for clients to invest in bitcoin and ethereum, which is stored in the third party custodian Gemini. In a single day, $36m worth of client funds were transferred between accounts and removed from the Gemini platform. These funds were then mixed. Unsurprisingly, insurance is not covering anything. At present, it appears that many client accounts are still locked and there is no note of any recovery for those affected.		[[File:Irafinancial.jpg\|thumb\|IRA Financial]]IRA Financial offers the ability for clients to invest in bitcoin and ethereum, which is stored in the third party custodian Gemini. In a single day, $36m worth of client funds were transferred between accounts and removed from the Gemini platform. These funds were then mixed. Unsurprisingly, insurance is not covering anything. At present, it appears that many client accounts are still locked and there is no note of any recovery for those affected.

	This exchange or platform is based in United States, or the incident targeted people primarily in United States.		This exchange or platform is based in United States, or the incident targeted people primarily in United States.
			<ref name="slowmist-2069" /><ref name="irafinancial-7067" /><ref name="prweb-7068" /><ref name="bloomberg-7069" /><ref name="theirafinancialtwitter-7070" /><ref name="youtube-7071" /><ref name="theirafinancialtwitter-7072" /><ref name="youtube-7073" /><ref name="theirafinancialtwitter-7074" /><ref name="yahoofinance-7075" /><ref name="theirafinancialtwitter-7076" /><ref name="irafinancialgroup-7077" /><ref name="trustpilot-7078" /><ref name="bloomberglawnews-7079" /><ref name="coindesk-7080" /><ref name="yahoofinance-7081" /><ref name="youtube-7082" /><ref name="youtube-7126" /><ref name="csoonline-9981" />

	== About IRA Financial ==		== About IRA Financial ==
Line 94:		Line 96:
	!Description		!Description
	\|-		\|-
	\|February 8th, 2022 ~~5:00:00 PM~~		\|February 8th, 2022
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 121:		Line 123:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== General Prevention Policies ==
			It seems most likely that IRA Financial did not utilize any form of multi-sig in their security setup, thereby allowing one staff member's credentials to become compromised. This could have been easily prevented by setting up a multi-signature wallet.
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

			== Platform Prevention Policies ==
			{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

	== Prevention Policies ==		== Regulatory Prevention Policies ==
	It seems most likely that IRA Financial did not utilize any form of multi-sig in their security setup, thereby allowing one staff member's credentials to become compromised. This could have been easily prevented by setting up a multi-signature wallet.		{{Prevention:Regulators:Placeholder}}

			{{Prevention:Regulators:End}}

	== References ==		== References ==
	[https://hacked.slowmist.io/en/ SlowMist Hacked - SlowMist Zone] (Jun 25)		<references><ref name="slowmist-2069">[https://hacked.slowmist.io/en/ SlowMist Hacked - SlowMist Zone] (Jun 26, 2021)</ref>

	[https://www.irafinancial.com/ Home - IRA Financial] (Mar 12)		<ref name="irafinancial-7067">[https://www.irafinancial.com/ Home - IRA Financial] (Mar 12, 2022)</ref>

	[https://www.prweb.com/releases/ira_financial_launches_new_digital_solution_for_using_ira_funds_to_buy_bitcoin_directly_from_cryptocurrency_exchange_and_custodian_gemini/prweb16734494.htm IRA Financial Launches New Digital Solution for Using IRA Funds to Buy Bitcoin Directly from Cryptocurrency Exchange and Custodian Gemini] (Mar 12)		<ref name="prweb-7068">[https://www.prweb.com/releases/ira_financial_launches_new_digital_solution_for_using_ira_funds_to_buy_bitcoin_directly_from_cryptocurrency_exchange_and_custodian_gemini/prweb16734494.htm IRA Financial Launches New Digital Solution for Using IRA Funds to Buy Bitcoin Directly from Cryptocurrency Exchange and Custodian Gemini] (Mar 12, 2022)</ref>

	[https://www.bloomberg.com/news/articles/2022-02-14/ira-financial-hacked-36-million-in-cryptocurrency-stolen Bloomberg - Are you a robot?] (Mar 12)		<ref name="bloomberg-7069">[https://www.bloomberg.com/news/articles/2022-02-14/ira-financial-hacked-36-million-in-cryptocurrency-stolen Bloomberg - Are you a robot?] (Mar 12, 2022)</ref>

	[https://twitter.com/TheIRAFinancial/status/1492663033373638659 @TheIRAFinancial Twitter] (Mar 12)		<ref name="theirafinancialtwitter-7070">[https://twitter.com/TheIRAFinancial/status/1492663033373638659 @TheIRAFinancial Twitter] (Mar 12, 2022)</ref>

	[https://www.youtube.com/watch?v=gLCowRn38kg A Message from Adam Bergman - Founder, IRA Financial - YouTube] (Mar 12)		<ref name="youtube-7071">[https://www.youtube.com/watch?v=gLCowRn38kg A Message from Adam Bergman - Founder, IRA Financial - YouTube] (Mar 12, 2022)</ref>

	[https://twitter.com/TheIRAFinancial/status/1493978096411807745 @TheIRAFinancial Twitter] (Mar 12)		<ref name="theirafinancialtwitter-7072">[https://twitter.com/TheIRAFinancial/status/1493978096411807745 @TheIRAFinancial Twitter] (Mar 12, 2022)</ref>

	[https://www.youtube.com/watch?v=FqaIhJtlBQQ An Update from Adam Bergman - Founder, IRA Financial - YouTube] (Mar 12)		<ref name="youtube-7073">[https://www.youtube.com/watch?v=FqaIhJtlBQQ An Update from Adam Bergman - Founder, IRA Financial - YouTube] (Mar 12, 2022)</ref>

	[https://twitter.com/TheIRAFinancial/status/1494714285607600128 @TheIRAFinancial Twitter] (Mar 12)		<ref name="theirafinancialtwitter-7074">[https://twitter.com/TheIRAFinancial/status/1494714285607600128 @TheIRAFinancial Twitter] (Mar 12, 2022)</ref>

	[https://finance.yahoo.com/news/drained-crypto-accounts-ira-financial-205505694.html Drained Crypto Accounts at IRA Financial Leave Victims Searching for Answers] (Mar 12)		<ref name="yahoofinance-7075">[https://finance.yahoo.com/news/drained-crypto-accounts-ira-financial-205505694.html Drained Crypto Accounts at IRA Financial Leave Victims Searching for Answers] (Mar 12, 2022)</ref>

	[https://twitter.com/TheIRAFinancial/status/1492319431640457216 @TheIRAFinancial Twitter] (Mar 12)		<ref name="theirafinancialtwitter-7076">[https://twitter.com/TheIRAFinancial/status/1492319431640457216 @TheIRAFinancial Twitter] (Mar 12, 2022)</ref>

	[https://www.irafinancialgroup.com/ Self-Direct Your Retirement - IRA Financial Group] (Mar 12)		<ref name="irafinancialgroup-7077">[https://www.irafinancialgroup.com/ Self-Direct Your Retirement - IRA Financial Group] (Mar 12, 2022)</ref>

	[https://www.trustpilot.com/review/irafinancialgroup.com https://www.trustpilot.com/review/irafinancialgroup.com] (Mar 12)		<ref name="trustpilot-7078">[https://www.trustpilot.com/review/irafinancialgroup.com https://www.trustpilot.com/review/irafinancialgroup.com] (Mar 12, 2022)</ref>

	[https://news.bloomberglaw.com/privacy-and-data-security/ira-financial-hacked-36-million-in-cryptocurrency-stolen https://news.bloomberglaw.com/privacy-and-data-security/ira-financial-hacked-36-million-in-cryptocurrency-stolen] (Mar 12)		<ref name="bloomberglawnews-7079">[https://news.bloomberglaw.com/privacy-and-data-security/ira-financial-hacked-36-million-in-cryptocurrency-stolen https://news.bloomberglaw.com/privacy-and-data-security/ira-financial-hacked-36-million-in-cryptocurrency-stolen] (Mar 12, 2022)</ref>

	[https://www.coindesk.com/business/2022/02/14/drained-crypto-accounts-at-ira-financial-leave-victims-searching-for-answers/ Drained Crypto Accounts at IRA Financial Leave Victims Searching for Answers] (Mar 12)		<ref name="coindesk-7080">[https://www.coindesk.com/business/2022/02/14/drained-crypto-accounts-at-ira-financial-leave-victims-searching-for-answers/ Drained Crypto Accounts at IRA Financial Leave Victims Searching for Answers] (Mar 12, 2022)</ref>

	[https://finance.yahoo.com/news/ira-financial-trust-loses-36-161112735.html IRA Financial Trust Loses $36 Million in Clients Funds] (Mar 12)		<ref name="yahoofinance-7081">[https://finance.yahoo.com/news/ira-financial-trust-loses-36-161112735.html IRA Financial Trust Loses $36 Million in Clients Funds] (Mar 12, 2022)</ref>

	[https://www.youtube.com/watch?v=vBN2qXEu3HY Why IRA Financial? - YouTube] (Mar 12)		<ref name="youtube-7082">[https://www.youtube.com/watch?v=vBN2qXEu3HY Why IRA Financial? - YouTube] (Mar 12, 2022)</ref>

	[https://www.youtube.com/watch?v=iIcX4je9bfk IRA Financial Services Breach Hackers Stole $36 Million In Cryptocurrency \| Cybersecurity News - YouTube] (Mar 12)		<ref name="youtube-7126">[https://www.youtube.com/watch?v=iIcX4je9bfk IRA Financial Services Breach Hackers Stole $36 Million In Cryptocurrency \| Cybersecurity News - YouTube] (Mar 12, 2022)</ref>

	[https://www.csoonline.com/article/2984989/cyber-insurance-rejects-claim-after-bitpay-lost-1-8-million-in-phishing-attack.html Cyber insurance rejects claim after BitPay lost $1.8 million in phishing attack \| CSO Online] (Dec 11)		<ref name="csoonline-9981">[https://www.csoonline.com/article/2984989/cyber-insurance-rejects-claim-after-bitpay-lost-1-8-million-in-phishing-attack.html Cyber insurance rejects claim after BitPay lost $1.8 million in phishing attack \| CSO Online] (Dec 11, 2022)</ref></references>

← Older revision		Revision as of 13:48, 26 February 2024
Line 1:		Line 1:
	{{Case Study Under Construction}}{{Unattributed Sources}}		{{Case Study Under Construction}}{{Unattributed Sources}}

	[[File:Irafinancial.jpg\|thumb\|IRA Financial Homepage, CEO, Logo]]IRA Financial offers the ability for clients to invest in bitcoin and ethereum, which is stored in the third party custodian Gemini. In a single day, $36m worth of client funds were transferred between accounts and ~~removed~~ from the Gemini platform. These funds were then mixed. Unsurprisingly, insurance is not covering anything. At present, it appears that many client accounts are still locked and there is no note of any recovery for those affected.		[[File:Irafinancial.jpg\|thumb\|IRA Financial Homepage, CEO, Logo]]IRA Financial offers the ability for clients to invest in bitcoin and ethereum, which is stored in the third party custodian Gemini. In a single day, $36m worth of client funds were transferred between accounts and withdrawn from the Gemini platform. These funds were then mixed. Unsurprisingly, insurance is not covering anything. At present, it appears that many client accounts are still locked and there is no note of any recovery for those affected.

	This exchange or platform is based in United States, or the incident targeted people primarily in United States.		This exchange or platform is based in United States, or the incident targeted people primarily in United States.<ref name="theirafinancialtwitter-7070" /><ref name="theirafinancialtwitter-7072" /><ref name="theirafinancialtwitter-7074" /><ref name="yahoofinance-7075" /><ref name="yahoofinance-7081" />
	~~<ref name="bloomberg-7069" />~~<ref name="theirafinancialtwitter-7070~~" /><ref name="youtube-7071~~" /><ref name="theirafinancialtwitter-7072~~" /><ref name="youtube-7073~~" /><ref name="theirafinancialtwitter-7074" /><ref name="yahoofinance-7075~~" /><ref name="bloomberglawnews-7079~~" /><ref name="yahoofinance-7081" />

	== About IRA Financial ==		== About IRA Financial ==
Line 27:		Line 26:
	“You have total control over your cryptos,” IRA Financial CEO Adam Bergman said in a May 3, 2021, video walk-through of “Gemini IRA account” onboarding, which included linking the IRA Financial and Gemini accounts together. In a later video on crypto insurance, his company assured viewers that “Gemini is regulated and insured against theft, so your cryptos are protected.”		“You have total control over your cryptos,” IRA Financial CEO Adam Bergman said in a May 3, 2021, video walk-through of “Gemini IRA account” onboarding, which included linking the IRA Financial and Gemini accounts together. In a later video on crypto insurance, his company assured viewers that “Gemini is regulated and insured against theft, so your cryptos are protected.”
	== The Reality ==		== The Reality ==
			IRA Financial was clearly not as secure as stated. Attackers or insiders at the company would later be able to remove funds from customer accounts. The platform's insurance was not able to cover losses from this theft.

	This sections is included if a case involved deception or information that was unknown at the time. Examples include:		This sections is included if a case involved deception or information that was unknown at the time. Examples include:

Line 78:		Line 79:
	\|February 11th, 2022 2:04:00 PM MST		\|February 11th, 2022 2:04:00 PM MST
	\|ErgoBTC Response		\|ErgoBTC Response
	\|"Asleep at the switch analysts frantically updating their ChipMixer detection scripts to bech32."<ref>[[ErgoBTC - "Asleep at the switch analysts frantically updating their ChipMixer detection scripts to bech32." - Twitter]] (Mar 15, 2024)</ref>.		\|"Asleep at the switch analysts frantically updating their ChipMixer detection scripts to bech32."<ref name=":1">[https://twitter.com/ErgoBTC/status/1492243844833939458 ErgoBTC - "Asleep at the switch analysts frantically updating their ChipMixer detection scripts to bech32." - Twitter] (Mar 15, 2024)</ref>.
	\|-		\|-
	\|February 11th, 2022 7:07:00 PM MST		\|February 11th, 2022 7:07:00 PM MST
Line 87:		Line 88:
	\|CoinDesk Article Published		\|CoinDesk Article Published
	\|CoinDesk reports that in a recent security breach, retirement accounts held at IRA Financial, which utilizes Gemini's institutional trading and custody suite, were compromised on February 8<ref name="coindesk-7080" />. Users reported drained and locked accounts, with an estimated loss of millions of dollars. The apparent breach involved a mass withdrawal of bitcoin, ether, and U.S. dollars from user accounts on the Gemini exchange. IRA Financial Trust, the crypto IRA firm, acknowledged the incident and is collaborating with forensic specialists to investigate. Gemini denies being hacked, placing the blame on IRA Financial. Victims express frustration over the lack of information and seek clarity on the extent of the breach, the number of affected accounts, and potential coverage for losses. The incident highlights challenges in securing crypto retirement accounts and raises questions about the responsibility of service providers in such cases<ref name="coindesk-7080" />. "The apparent victims tell CoinDesk they are trapped in a knotty morass of incomplete facts that only confound a fraught situation. Even basic details – how many accounts were breached, who (if anyone) will cover their losses – remain unclear. Some receive occasional terse email updates from IRA Financial while others are forced to call every day, users tell CoinDesk."		\|CoinDesk reports that in a recent security breach, retirement accounts held at IRA Financial, which utilizes Gemini's institutional trading and custody suite, were compromised on February 8<ref name="coindesk-7080" />. Users reported drained and locked accounts, with an estimated loss of millions of dollars. The apparent breach involved a mass withdrawal of bitcoin, ether, and U.S. dollars from user accounts on the Gemini exchange. IRA Financial Trust, the crypto IRA firm, acknowledged the incident and is collaborating with forensic specialists to investigate. Gemini denies being hacked, placing the blame on IRA Financial. Victims express frustration over the lack of information and seek clarity on the extent of the breach, the number of affected accounts, and potential coverage for losses. The incident highlights challenges in securing crypto retirement accounts and raises questions about the responsibility of service providers in such cases<ref name="coindesk-7080" />. "The apparent victims tell CoinDesk they are trapped in a knotty morass of incomplete facts that only confound a fraught situation. Even basic details – how many accounts were breached, who (if anyone) will cover their losses – remain unclear. Some receive occasional terse email updates from IRA Financial while others are forced to call every day, users tell CoinDesk."
			\|-
			\|February 14th, 2022 3:37:00 PM MST
			\|Bloomberg Article Published
			\|Bloomberg reports on the situation. The article references the statement from IRA Financial Trust that “suspicious activity that has affected a limited subset of our customers with accounts on the Gemini cryptocurrency exchange. Upon discovery, we immediately launched an investigation and contacted state and federal law enforcement.”<ref name="bloomberg-7069" />
	\|-		\|-
	\|February 15th, 2022 4:11:12 PM MST		\|February 15th, 2022 4:11:12 PM MST
Line 137:		Line 142:

	Details were slow to come out about the situation, leaving many affected users without answers even a full week after the theft<ref name="coindesk-7080" />.<blockquote>"The apparent victims tell CoinDesk they are trapped in a knotty morass of incomplete facts that only confound a fraught situation. Even basic details – how many accounts were breached, who (if anyone) will cover their losses – remain unclear. Some receive occasional terse email updates from IRA Financial while others are forced to call every day, users tell CoinDesk."</blockquote>		Details were slow to come out about the situation, leaving many affected users without answers even a full week after the theft<ref name="coindesk-7080" />.<blockquote>"The apparent victims tell CoinDesk they are trapped in a knotty morass of incomplete facts that only confound a fraught situation. Even basic details – how many accounts were breached, who (if anyone) will cover their losses – remain unclear. Some receive occasional terse email updates from IRA Financial while others are forced to call every day, users tell CoinDesk."</blockquote>


			TBD: <ref name=":1" />

	== Ultimate Outcome ==		== Ultimate Outcome ==
Line 159:		Line 167:

	=== IRA Financial Posts/Media Deleted ===		=== IRA Financial Posts/Media Deleted ===
	Several videos posted by IRA Financial were removed from YouTube<ref name="coindesk-7080" /><ref>https://www.youtube.com/watch?v=VhuB3QAAFck (Jan 25, 2024)</ref><ref>https://www.youtube.com/watch?v=ZHzcFYXEjmg (Jan 25, 2024)</ref>.		Several videos posted by IRA Financial were removed from YouTube<ref name="coindesk-7080" /><ref>https://www.youtube.com/watch?v=VhuB3QAAFck (Jan 25, 2024)</ref><ref>https://www.youtube.com/watch?v=ZHzcFYXEjmg (Jan 25, 2024)</ref><ref name="youtube-7071" /><ref>[https://web.archive.org/web/20220218174401/https://www.youtube.com/watch?v=gLCowRn38kg A Message from Adam Bergman - Founder, IRA Financial - YouTube Archive February 18th, 2022 10:44:01 AM MST] (Feb 26, 2024)</ref><ref name="youtube-7073" /><ref>[https://web.archive.org/web/20220219102949/https://www.youtube.com/watch?v=FqaIhJtlBQQ An Update from Adam Bergman - Founder, IRA Financial - YouTube Archive February 19th, 2022 3:29:49 AM MST] (Feb 26, 2024)</ref>.

	Additionally, IRA Financial removed tweets related to the incident<ref name="theirafinancialtwitter-7076" /><ref>[https://twitter.com/TheIRAFinancial/status/1492319431640457216 IRA Financial - Deleted Tweet - Twitter] (Jan 25, 2024)</ref>.		Additionally, IRA Financial removed tweets related to the incident<ref name="theirafinancialtwitter-7076" /><ref>[https://twitter.com/TheIRAFinancial/status/1492319431640457216 IRA Financial - Deleted Tweet - Twitter] (Jan 25, 2024)</ref>.
Line 170:		Line 178:


	"The apparent victims tell CoinDesk they are trapped in a knotty morass of incomplete facts that only confound a fraught situation.		"The apparent victims tell CoinDesk they are trapped in a knotty morass of incomplete facts that only confound a fraught situation.

	Even basic details – how many accounts were breached, who (if anyone) will cover their losses – remain unclear. Some receive occasional terse email updates from IRA Financial while others are forced to call every day, users tell CoinDesk."		Even basic details – how many accounts were breached, who (if anyone) will cover their losses – remain unclear. Some receive occasional terse email updates from IRA Financial while others are forced to call every day, users tell CoinDesk."

	"Blockchain analysis firm Chainalysis Inc. said it was tracking the $36 million in cryptocurrency stolen from IRA customers, and said that it is being laundered through a “mixer” service known as Tornado. A representative for Tornado didn’t immediately respond to a request for comment."		"Blockchain analysis firm Chainalysis Inc. said it was tracking the $36 million in cryptocurrency stolen from IRA customers, and said that it is being laundered through a “mixer” service known as Tornado. A representative for Tornado didn’t immediately respond to a request for comment."
	== Individual Prevention Policies ==		== Individual Prevention Policies ==
	There were a number of deficiencies in the IRA Finance model, and users ~~should have demanded greater security certainty~~.		There were a number of deficiencies in the IRA Finance model, and users had limited visibility to be able to review these deficiencies. It was unclear who held the funds, and many users were misinformed about the insurance which was available to assist them.

	{{Prevention:Individuals:Avoid Third Party Custodians}}		{{Prevention:Individuals:Avoid Third Party Custodians}}
Line 212:		Line 221:
	<ref name="irafinancial-7067">[https://www.irafinancial.com/ Home - IRA Financial] (Mar 12, 2022)</ref>		<ref name="irafinancial-7067">[https://www.irafinancial.com/ Home - IRA Financial] (Mar 12, 2022)</ref>
	<ref name="prweb-7068">[https://www.prweb.com/releases/ira_financial_launches_new_digital_solution_for_using_ira_funds_to_buy_bitcoin_directly_from_cryptocurrency_exchange_and_custodian_gemini/prweb16734494.htm IRA Financial Launches New Digital Solution for Using IRA Funds to Buy Bitcoin Directly from Cryptocurrency Exchange and Custodian Gemini] (Mar 12, 2022)</ref>		<ref name="prweb-7068">[https://www.prweb.com/releases/ira_financial_launches_new_digital_solution_for_using_ira_funds_to_buy_bitcoin_directly_from_cryptocurrency_exchange_and_custodian_gemini/prweb16734494.htm IRA Financial Launches New Digital Solution for Using IRA Funds to Buy Bitcoin Directly from Cryptocurrency Exchange and Custodian Gemini] (Mar 12, 2022)</ref>
	<ref name="bloomberg-7069">[https://www.bloomberg.com/news/articles/2022-02-14/ira-financial-hacked-36-million-in-cryptocurrency-stolen Bloomberg ~~- Are you a robot?~~] (Mar 12, 2022)</ref>		<ref name="bloomberg-7069">[https://www.bloomberg.com/news/articles/2022-02-14/ira-financial-hacked-36-million-in-cryptocurrency-stolen Hackers Steal $36 Million in Crypto in IRA Financial Breach - Bloomberg] (Mar 12, 2022)</ref>
	<ref name="theirafinancialtwitter-7070">[https://twitter.com/TheIRAFinancial/status/1492663033373638659 ~~@TheIRAFinancial~~ Twitter] (Mar 12, 2022)</ref>		<ref name="theirafinancialtwitter-7070">[https://web.archive.org/web/20220213005805/https://twitter.com/TheIRAFinancial/status/1492663033373638659 IRA Financial - "Update From Adam Bergman - Founder of IRA Financial Trust" - Twitter Archive February 12th, 2022 5:58:05 PM MST] (Mar 12, 2022)</ref>
	<ref name="youtube-7071">[https://www.youtube.com/watch?v=gLCowRn38kg A Message from Adam Bergman - Founder, IRA Financial - YouTube] (Mar 12, 2022)</ref>		<ref name="youtube-7071">[https://www.youtube.com/watch?v=gLCowRn38kg A Message from Adam Bergman - Founder, IRA Financial - YouTube] (Mar 12, 2022)</ref>
	<ref name="theirafinancialtwitter-7072">[https://twitter.com/TheIRAFinancial/status/1493978096411807745 ~~@TheIRAFinancial~~ Twitter] (Mar 12, 2022)</ref>		<ref name="theirafinancialtwitter-7072">[https://web.archive.org/web/20220216160602/https://twitter.com/TheIRAFinancial/status/1493978096411807745 IRA Financial - "A Message from Adam Bergman, Founder of IRA Financial" - Twitter Archive February 16th, 2022 9:06:02 AM MST] (Mar 12, 2022)</ref>
	<ref name="youtube-7073">[https://www.youtube.com/watch?v=FqaIhJtlBQQ An Update from Adam Bergman - Founder, IRA Financial - YouTube] (Mar 12, 2022)</ref>		<ref name="youtube-7073">[https://www.youtube.com/watch?v=FqaIhJtlBQQ An Update from Adam Bergman - Founder, IRA Financial - YouTube] (Mar 12, 2022)</ref>
	<ref name="theirafinancialtwitter-7074">[https://web.archive.org/web/20220218164916/https://twitter.com/TheIRAFinancial/status/1494714285607600128 IRA Financial - "An updated message from Adam Bergman, Founder, IRA Financial." - Twitter Archive February 18th, 2022 9:49:16 AM MST] (Mar 12, 2022)</ref>		<ref name="theirafinancialtwitter-7074">[https://web.archive.org/web/20220218164916/https://twitter.com/TheIRAFinancial/status/1494714285607600128 IRA Financial - "An updated message from Adam Bergman, Founder, IRA Financial." - Twitter Archive February 18th, 2022 9:49:16 AM MST] (Mar 12, 2022)</ref>
	<ref name="yahoofinance-7075">[https://finance.yahoo.com/news/drained-crypto-accounts-ira-financial-205505694.html Drained Crypto Accounts at IRA Financial Leave Victims Searching for Answers] (Mar 12, 2022)</ref>		<ref name="yahoofinance-7075">[https://finance.yahoo.com/news/drained-crypto-accounts-ira-financial-205505694.html Drained Crypto Accounts at IRA Financial Leave Victims Searching for Answers - Yahoo Finance] (Mar 12, 2022)</ref>
	<ref name="theirafinancialtwitter-7076">[https://web.archive.org/web/20220212021239/https://twitter.com/TheIRAFinancial/status/1492319431640457216 IRA Financial - "On February 8, 2022, IRA Financial Trust discovered suspicious activity that has affected a limited subset of our customers with accounts on the Gemini cryptocurrency exchange." - Twitter Archive February 11th, 2022 7:12:39 PM MST] (Mar 12, 2022)</ref>		<ref name="theirafinancialtwitter-7076">[https://web.archive.org/web/20220212021239/https://twitter.com/TheIRAFinancial/status/1492319431640457216 IRA Financial - "On February 8, 2022, IRA Financial Trust discovered suspicious activity that has affected a limited subset of our customers with accounts on the Gemini cryptocurrency exchange." - Twitter Archive February 11th, 2022 7:12:39 PM MST] (Mar 12, 2022)</ref>
	<ref name="irafinancialgroup-7077">[https://www.irafinancialgroup.com/ Self-Direct Your Retirement - IRA Financial Group] (Mar 12, 2022)</ref>		<ref name="irafinancialgroup-7077">[https://www.irafinancialgroup.com/ Self-Direct Your Retirement - IRA Financial Group] (Mar 12, 2022)</ref>