If you’re a user of the Gemini cryptocurrency exchange, it’s time to be on your guard against phishing attacks. Gemini says its own systems have not been compromised, but an unnamed third party has become the focal point for a breach.

On December 13 or some point before, rogues gained access to just shy of 6 million email details and “incomplete” phone numbers (thanks to partial redaction) belonging to users of the Gemini service. It’s claimed there are duplicate email records in the breach, so the actual impact is probably not quite as severe as initial numbers may suggest. All the same, if we’re talking millions of records then it’s still very much a bad thing.

(Failing to) monetise data for fun and profit

There have been several attempts to monetise this data on underground forums over the last couple of months, from September onward, with little evident success. This eventually resulted in someone offering up all of the data for free.

Gemini is now offering security advice and tips to guard against phishing attacks for anyone contained in the data. From Gemini's post on the subject:

Some Gemini customers have recently been the target of phishing campaigns that we believe are the result of an incident at a third-party vendor. This incident led to the collection of Gemini customer email addresses and partial phone numbers. No Gemini account information or systems were impacted as a result of this third-party incident, and all funds and customer accounts remain secure.

Locking down your Gemini account

Breaches in cryptocurrency land are always a major issue. Some folks have their life savings and investments in these realms, and cryptocurrency/Web3 phishing generally has been running riot for some time now. If it’s not stolen apes and coins, it’s fake social media giveaways and “double your money” scams.

If you’re a Gemini user, the advice is to

• Be on the look out for emails pretending to be from Gemini. It may well be a phishing attempt. Don't click on links in any emails and navigate to the site itself instead.

• Sign up to 2FA, to give phishers an additional mountain to climb should they manage to obtain your password. You can use your mobile phone for this, or even more secure forms of protection like a physical hardware key.

Cryptocurrency attacks will continue into 2023

No matter which platform you use, no matter what smart wallets you dabble in, someone out there is happy to steal whatever you have. Exploits, platform owners going rogue, rug pulls, insecure platforms: something big can go wrong at any time. While it may still be one of the hottest things around, cryptocurrency is a huge bullseye for anyone up to no good. Take the time to learn as much as you can about your platform of choice, scams common to your particular cryptocurrency corner, and ways you can try and mitigate those threats. Once your digital money is gone, there’s often no coming back so forewarned is most definitely forearmed.

We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.