{"id":57759,"date":"2022-02-15T11:07:39","date_gmt":"2022-02-15T09:07:39","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=57759"},"modified":"2025-09-04T13:23:20","modified_gmt":"2025-09-04T10:23:20","slug":"media-unknown-actor-withdrew-36-million-from-ira-financial-trusts-pension-crypto-accounts","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/media-unknown-actor-withdrew-36-million-from-ira-financial-trusts-pension-crypto-accounts\/","title":{"rendered":"Media: Unknown actor withdrew $36 million from IRA Financial Trust&#8217;s pension crypto accounts"},"content":{"rendered":"<p>The attacker moved assets from the managed IRA Financial Trust pension accounts to the Gemini Bitcoin exchange. According to <a href=\"https:\/\/www.bloomberg.com\/news\/articles\/2022-02-14\/ira-financial-hacked-36-million-in-cryptocurrency-stolen\">Bloomberg<\/a>, the loss totaled $36 million in Bitcoin and Ethereum.<\/p>\n<p>On Reddit forums, affected clients reported transfers of their assets to accounts controlled by an individual using the alias Benjamin Choe. Others, in interviews with <a href=\"https:\/\/www.coindesk.com\/business\/2022\/02\/14\/drained-crypto-accounts-at-ira-financial-leave-victims-searching-for-answers\/\">CoinDesk<\/a>, reported funds being blocked without explanation and difficulties obtaining information from IRA Financial Trust representatives.<\/p>\n<p>On the day of the breach, February 8, the firm urged customers to beware of phishing, and after the incident said that it had become a target of hackers. As a precaution, access to client accounts at IRA Financial Trust was suspended.<\/p>\n<p>Five days later, the firm said that \u201call funds are safe\u201d. According to the statement, \u201cthe suspicious activity affected a limited number of clients\u201d. Staff began an investigation and contacted law enforcement.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"und\" dir=\"ltr\"><a href=\"https:\/\/t.co\/QWn1KTS6ph\">pic.twitter.com\/QWn1KTS6ph<\/a><\/p>\n<p>\u2014 IRA Financial (@TheIRAFinancial) <a href=\"https:\/\/twitter.com\/TheIRAFinancial\/status\/1492663033373638659?ref_src=twsrc%5Etfw\">February 13, 2022<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Chainalysis specialists noted the attacker\u2019s use of the Tornado Cash mixer.<\/p>\n<p>Representatives of IRA Financial Trust said they were examining controls for vulnerabilities and did not provide details of a plan to return funds to affected users.<\/p>\n<p>Gemini stressed that the security measures offered for institutional clients like IRA Financial Trust are mandatory for all accounts and approved addresses. The Bitcoin exchange said there was no compromise of its systems and expressed readiness to assist IRA Financial Trust in investigating the incident.<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><em>&#8220;While IRA Financial accounts are serviced by Gemini, the platform does not manage the security of the pension program provider. \u2026 To date, we have found no signs of unauthorized access to the IRA Financial account as a result of any security-system failure or breach of Gemini&#8217;s systems&#8221;<\/em>, the company explained.<\/p>\n<\/blockquote>\n<p>IRA Financial did not respond to CoinDesk&#8217;s request about whether the company holds an insurance policy covering theft of funds.<\/p>\n<p>Earlier, a white-hat hacker <a href=\"https:\/\/forklog.com\/en\/news\/white-hat-hacker-uncovers-vulnerability-in-coinbases-retail-trading-platform\">discovered<\/a> a vulnerability in Coinbase&#8217;s retail trading platform.<\/p>\n<p>Subscribe to ForkLog News on Telegram: <a href=\"https:\/\/t.me\/forklogfeed\" target=\"_blank\" rel=\"nofollow noopener\">ForkLog Feed<\/a> \u2014 all the news feed, <a href=\"https:\/\/telegram.me\/forklog\" target=\"_blank\" rel=\"nofollow noopener\">ForkLog<\/a> \u2014 the most important news, infographics and opinions<\/p>\n","protected":false},"excerpt":{"rendered":"<p>An attacker moved assets from the managed IRA Financial Trust pension accounts to the Gemini Bitcoin exchange. According to Bloomberg, the loss totaled $36 million in Bitcoin and Ethereum.<\/p>\n","protected":false},"author":1,"featured_media":57760,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[1154,719],"class_list":["post-57759","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-crimes","tag-gemini"],"aioseo_notices":[],"amp_enabled":true,"views":"16","promo_type":"1","layout_type":"1","short_excerpt":"","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/57759","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=57759"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/57759\/revisions"}],"predecessor-version":[{"id":57761,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/57759\/revisions\/57761"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/57760"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=57759"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=57759"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=57759"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}