(Bloomberg) — A hack at IRA Financial Trust, which offers self-directed retirement accounts, resulted in the theft of $36 million in cryptocurrency, according to a person familiar with the investigation.
Ira Financial Trust said in a statement on Feb. 8 found “suspicious activity that affected a limited subset of our customers with accounts on the Gemini cryptocurrency exchange. Upon detection, we immediately launched an investigation and contacted state and federal law enforcement.”
On the same day, unidentified hackers withdrew $21 million in bitcoin and $15 million in ethereum from the accounts of IRA Financial Trust customers, the person said. The IRA allows its customers to purchase cryptocurrencies through a partnership with the cryptocurrency exchange Gemini Trust Company.
Blockchain analysis firm Chainalysis Inc. said it was tracking $36 million in cryptocurrency stolen from IRA customers, adding that it was via a “mixer” service known as Tornado. A representative for Tornado did not immediately respond to a request for comment.
It is not clear who may be responsible for the money lost. IRA Financial spokeswoman Maria Stagliano said the company’s investigation focused primarily on security controls that were not offered to IRA Financial Claims or were not available from Gemini. He declined to say who controls IRA Financial.
Stagliano also declined to answer questions about who might be behind the hack and did not provide details on any plans to repay users whose cryptocurrency was stolen.
A Gemini spokesperson said that in a statement, Gemini pushed back, saying that it offers a number of security controls for institutional clients like IRA Financial, including two-factor authentication that is mandatory on all accounts and accepted addresses. .
Gemini said it was not breached, and that it was offering to assist the IRA Financial Trust in its investigation.
“We are aware that IRA Financial experienced a security incident last week,” the company said in a statement. “While IRA Financial’s accounts are serviced on the Gemini platform, Gemini does not manage the security of IRA Financial’s systems.”
Clear IRA Financial users who posted in forums on Reddit Inc. said they emptied their crypto accounts, with the thieves directing the stolen funds into a Roth IRA account with the name “Benjamin Cho”. Money from the Chow account was later sent to services that were often used to launder cryptocurrency. Some users said that the cash deposited in their accounts was also taken away.
One Reddit user wrote, “My Gemini account only had cash, no coins, and it all went to Cho in multiple transfers at $10k per transfer.” “So in just 15 seconds they took all my cash.”
Another user wrote, “All my BTC and Ether have also been transferred. I can confirm that they only transferred entire units and left BTC and a small fraction of my cash.” The user said, “Transfers were made to Cho Roth in multiple 1 whole unit coin transactions.”
