Gemini gemini.com Gemini data breach 2022: what happened and what to do
In late 2022 a hacker posted data said to come from the Gemini crypto exchange: 5,274,214 email addresses and partial phone numbers. HIBP says the claim was false and the data came from an incident at Twilio, which handled some Gemini customers' 2FA.
View all 13,115 breaches- Breach date
- 13 Dec 2022
- Affected
- 5,274,214
- Data exposed
- Email addresses, Partial phone numbers
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In December 2022, a hacker posted a data set on a public hacking forum and said it came from the Gemini crypto exchange. Have I Been Pwned (HIBP) added it on 16 December 2022 with 5,274,214 records.
The claim that Gemini's systems were hacked turned out to be false. The data was traced to an incident at a third-party vendor. The source was Twilio, which processed data for some Gemini customers through its Authy two-factor authentication service. Twilio described its incident as a sophisticated social engineering attack designed to steal employee credentials.
What was exposed
HIBP lists email addresses and partial phone numbers. Passwords were not part of it.
That sounds small, but for crypto holders it is a targeted list: people who very likely own digital assets, with a way to contact them. Scammers use lists like this for phishing that pretends to be Gemini or another exchange, and for attempts to take over a phone number (a SIM swap), which can then be used to reach exchange accounts that rely on text messages for 2FA.
What this means for you
If you used Gemini and Authy in 2022, your email may be in the file. The practical protection is to stop relying on a phone number as the only thing between an attacker and your account.
What to do if you were in it
- 1
Use an authenticator app or security key for 2FA
Move exchange and email accounts off text message codes. Authenticator apps and hardware keys can't be taken over by swapping a SIM.
- 2
Treat messages that mention Gemini with suspicion
Fake support messages, withdrawal alerts and wallet prompts are the usual follow-up to a leak like this. Go to the exchange's site directly and never share seed phrases.
- 3
Ask your mobile carrier to lock your number
Set a PIN or port-out lock with your carrier so nobody can move your number to another SIM without it.
- 4
Check whether your email or phone is in this and other breaches
Run a free scan with Serus. It looks for your email and phone number in breach databases and on the dark web, and alerts you if they show up. Breach data can't be taken down, so the scan tells you what to change instead.
Frequently asked
Was Gemini hacked in 2022?
According to HIBP, the claim was later proven false. The data traced back to a third-party vendor, Twilio, whose Authy service processed some Gemini customers' 2FA data.
What was exposed?
Email addresses and partial phone numbers, across 5,274,214 records.
Was I affected?
Search your email on Have I Been Pwned. If Gemini is listed, your email was in the data.
Should I change my password?
Passwords weren't in the data. Focus on moving to an authenticator app or security key for 2FA.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
