Gemini Exchange

Documented and closed events. They stay on file: an operator’s past is data, not a verdict.

1. Jun 3, 2024 Data breach Severe ✓ resolved

   Breach at the ACH provider: full name, bank account number and routing number of about 15,000 customers

   Between 3 and 7 June 2024 an unauthorised party entered the internal collaboration tool of the provider that handles ACH transfers for Gemini — the US bank debit and credit rail — and accessed the data of roughly 15,000 Gemini customers. The exposed information is full name, bank account number and routing number used for ACH transfers: not a contact list, but the details with which a debit is instructed against an account. According to the published reconstruction, date of birth, home address, email address, social security number, phone number, username and password were NOT exposed. Gemini emailed affected customers on 25 June 2024 and sent the formal breach notification letters on 24 July 2024. The company's official statement is short and should be reported as it stands: "The incident at a third party involved information of approximately 15K Gemini customers. Although we notified the customers involved out of an abundance of caution, our analysis found no evidence of customer impact." As in the 2022 case, Gemini's own systems were not breached: the entry point was a vendor. ⚠️ The ACH provider has not been named, no technical post-mortem has been published, and no closing communication after the 24 July letters is on record. The distinction between "no evidence of impact" and "no impact" is the company's, not ours: a bank account number and a routing number, once out, remain usable indefinitely.

   ↗ source
2. Dec 14, 2022 Data breach Moderate ✓ resolved

   Email addresses and partial phone numbers of millions of customers collected at a vendor and dumped on hacking forums

   On 14 December 2022 Gemini published a notice on its official blog about phishing campaigns aimed at its customers, explaining that "an incident at a third-party vendor" had allowed an unauthorised actor to collect email addresses and partial phone numbers of some customers. The same day an archive of 5,701,649 lines carrying that data began circulating; Have I Been Pwned, which indexed it on 16 Dec 2022, counts roughly 5.3 million distinct accounts — the two figures differ because the lines include duplicates, so read the first as the size of the archive and the second as the number of people. The phone numbers were truncated, with some digits hidden. The company states the archive did NOT contain names, addresses or KYC documentation, and above all that "no Gemini account information or systems were impacted" and that "all funds and customer accounts remain secure": the breach was the vendor's, not the exchange's. The data did not appear out of nowhere: it had been on sale on forums since September 2022 for 30 bitcoin (about 520,000 dollars at the time), reoffered in October and in mid-November bundled with archives from other exchanges, and only later published for free. ⚠️ Gemini never named the vendor. Have I Been Pwned attributes the origin to Twilio, which processed Gemini customer data through its Authy two-factor authentication service and which traced its own breach to "a sophisticated social engineering attack designed to steal employee credentials": it is a coherent third-party attribution, but the company has not confirmed it and it should be kept distinct from the facts it did state. No post-mortem, no official count of affected customers.

   ↗ source

verified on Sep 30, 2026

Weighted average across 1 public review platform (109,631 reviews in total), weighted by volume. This is not our rating: it is those platforms’ average.