Gemini, a U.S.-based cryptocurrency exchange, had the contact information of approximately 5.3 million customers exposed after a dataset surfaced on cybercrime forums in December 2022. The breach did not originate from Gemini's own systems. Instead, attackers used social engineering to compromise employees at Twilio's Authy service, a two-factor authentication provider used by Gemini, and extracted customer data through that supply chain connection. The exposed data consisted of email addresses and partial phone numbers. No passwords, wallet credentials, or financial data were included. Even so, the exposure posed a serious risk to affected users. Cryptocurrency holders are high-value targets, and the leaked contact details were quickly weaponized in phishing and smishing campaigns. Attackers impersonated Gemini support across email, SMS, WhatsApp, and Telegram to steal login credentials or trick users into transferring funds. The data also raised concerns about SIM-swapping attacks, in which criminals hijack a victim's phone number to bypass account security. Gemini confirmed the breach and notified affected customers. No prominent regulatory action or settlement specific to this incident has been documented. Affected individuals remain at elevated risk of targeted phishing, account takeover, and financial fraud, and should treat any unsolicited outreach claiming to be from Gemini with suspicion.

Crypto exchanges and custodians collect highly sensitive identity verification records, contact data, financial information, transaction history, device and login metadata, and custody-related account records.

Gemini has continued building out its regulated exchange and custody operations. The company navigated the broader crypto market downturn of 2022-2023 and the collapse of several competitor platforms. It launched a credit card product and has maintained its focus on institutional and retail custody. Gemini reached a settlement with the New York Attorney General in 2025 related to allegations that its Earn program had defrauded users.