Gemini Data Breach (2022): What Was Exposed & What To Do

Supply-chain and third-party compromises have become a persistent feature of the modern threat landscape, especially for financial platforms that rely on specialised vendors for authentication and customer communications. Incidents of this kind often surface first as unverified dumps on public forums, leaving organisations and users to untangle what was actually exposed and by whom.

In December 2022 a data set alleged to belong to the cryptocurrency exchange Gemini was posted online. Subsequent investigation established that the material did not originate from Gemini itself but from a third-party vendor. Approximately 5.3 million people were affected; the confirmed data types were email addresses and partial phone numbers. The episode illustrates how quickly a vendor breach can be misattributed and why customers of crypto platforms remain exposed even when the primary firm is not the direct point of failure.

What happened

On or around 13 December 2022 a hacker posted a data set to a public hacking forum and claimed it had been taken from Gemini, the cryptocurrency exchange. That claim was later shown to be false. Investigators traced the data to an incident at Twilio, a third-party vendor that processed information for some Gemini customers through its Authy service, which is used for two-factor authentication. Twilio characterised the intrusion as a sophisticated social-engineering attack aimed at stealing employee credentials. Public reporting has not disclosed the precise technical method beyond that description, nor has it released a full forensic timeline. The number of people whose information appeared in the set is given as 5.3 million; the named data elements are email addresses and partial phone numbers.

How a breach like this happens

Incidents involving authentication vendors commonly begin with social engineering. Attackers craft convincing messages or calls that persuade an employee to reveal credentials or to approve a fraudulent access request. Once inside the vendor’s environment, the attacker can reach customer records that the vendor holds in the course of providing services such as SMS or app-based two-factor authentication. Because many companies outsource these functions, a single successful compromise can expose data belonging to multiple client organisations. The stolen material is then often packaged and offered or dumped on criminal forums, sometimes with an incorrect or exaggerated attribution intended to increase its perceived value. Defenders typically discover the exposure only after the data appears publicly or after the vendor completes its own investigation and notifies affected clients.

Gemini and its sector

Gemini is a cryptocurrency exchange that allows customers to buy, sell and store digital assets. Firms in this sector routinely hold account identifiers, contact details and authentication data so that users can secure their wallets and receive transaction alerts. Because crypto balances are bearer assets that can be transferred irreversibly, any leakage of contact or authentication-related information raises the risk of targeted phishing or account-takeover attempts. Reliance on specialised two-factor-authentication providers is standard industry practice; consequently a breach at one of those providers can affect customers even when the exchange’s own systems remain uncompromised. The consequential nature of such an event therefore stems less from the exchange’s direct security posture and more from the interconnected web of vendors that support modern financial platforms.

The information in question

The data types confirmed as exposed are email addresses and partial phone numbers. Public reporting does not list additional elements such as full phone numbers, passwords, government identifiers or wallet keys. Organisations of Gemini’s type typically maintain richer customer records—including full contact details, device information and authentication logs—but the exact contents of the set released in this incident remain limited to what has been publicly named. Because the material was first misattributed to Gemini and only later linked to Twilio’s Authy service, the precise scope of records tied solely to Gemini customers has not been further itemised in available disclosures.

Why it matters

Email addresses and partial phone numbers are sufficient building blocks for phishing and smishing campaigns. An attacker who knows that an address is associated with a cryptocurrency account can craft messages that appear to come from the exchange or from its authentication provider, increasing the chance that a recipient will click a malicious link or surrender additional credentials. For the individuals affected, the practical risk is therefore elevated social-engineering exposure rather than immediate theft of funds. For Gemini and similar platforms the incident underscores the reputational and operational cost of vendor breaches: customers may lose confidence, support teams face higher volumes of inquiries, and the firm must coordinate notifications and remediation with a third party whose security it does not directly control. No dollar loss figure or confirmed secondary fraud total has been publicly attached to this specific event.

What to do if you're exposed

If you maintained an account with Gemini or used Authy around the time of the incident, treat unsolicited messages that reference your email or partial phone number with caution. Verify any security alert by navigating directly to the official site or app rather than following embedded links. Enable stronger authentication options where available, and consider placing fraud alerts with relevant services if you notice suspicious activity. Readers can also run a free exposure scan of their email address to check whether their information has appeared in known breach data sets, which provides an additional early-warning signal beyond official notifications.

AICompiled with AI assistance from public sources and published under our editorial standards.