Consumer complaint received 2022-05-18
Product: Money transfer, virtual currency, or money service — Virtual currency
Issue: Fraud or scam — 
Company: Winklevoss Exchange LLC (CA)

Dear Consumer Financial Protection Bureau, I am one of hundreds of victims of theft of cryptocurrency off the exchange run by Gemini Trust Company , LLC ( d/b/aXXXX Gemini XXXX, XXXX ) ( Gemini ) that resulted from Geminis unfair, deceptive, or abusive acts or practices ( UDAAPs ), in violation of the Dodd-Frank Act, 12 U.S.C. 5531. In short, as a result of Geminis failure to adequately safeguard self-directed retirement assets on its exchange from foreseeable misconduct, hackers were able to fraudulently transfer tens of millions of dollars worth of cryptocurrency off the exchange on XX/XX/XXXX, including [ Amount ] ETH from my account. 

Gemini lured myself and the other victims in by selling security and trust : Trust is our product, they tell the public. We bought it and were led to believe Gemini would adequately safeguard our valuable retirement assets. Gemini advertises its industry leading security, and broadcasts unequivocally that All crypto held online in our exchange wallet is insured. It was precisely statements like these that led me ( and others ) to believe my self-directed retirement funds would be safe on the Gemini exchange and therefore to select a custodian that advertised a partnership with Gemini for this very purpose. At no time, prior to the theft of assets, did Gemini provide any indication that they would not put the full force of their company resources and highly touted security program behind the protection of my assets. To the contrary, upon signing up with Gemini, they sent welcome letters, reiterating promises of their security-first mentality and an ethos of asking for permission, not forgiveness, and they promised the full Gemini experience. 

I, and other victims, had every reason to rely on Geminis representations in establishing trust and selecting a place to buy and store valuable retirement assets. However, based on Geminis responses to my inquiries ( and those of other victims ) to date, these representations proved to be unbelievably deceptive. Gemini now claims that all security measures to protect the tens of millions of crypto held on Geminis exchange fell on XXXX XXXX relatively small company that, among other things, takes miniscule fees compared to those taken by Gemini for buying and holding crypto, and that does not sell its product based on its own security but rather that of Gemini. Even though Gemini promised ( among other industry-leading security ) two-factor authentication ( 2FA ), protections against single point of failure, and that in any event crypto is insured against fraud, victims were not notified ( via 2FA or otherwise ) of the withdrawals that Gemini says was due 100 % to IRA Financial ( a single-point of failure ) being severely compromised, and the assets were not insured against this loss. 

Gemini violated the Dodd-Frank Act by engaging in UDAAPs and harming the victims in several ways. This included unfair acts and practices in the form of inadequate safeguards that caused injuries not reasonably avoidable by consumers. It also included deceptive practices in the form of material misrepresentations reasonably misleading and injuring consumers. Gemini also appears to have violated both state law and possibly the Electronic Funds Transfer Act ( EFTA ), each of which violation would constitute an actionable UDAAP under Dodd-Frank Act as well as a violation of the underlying laws These violations are detailed below.

I. Geminis Unfair Acts and Practices : Failure to Establish Appropriate Policies and Procedures to Prevent, Detect, or Remedy Fraudulent Activity Harming Consumers The fraud that occurred on XX/XX/XXXX was stark. Hackers were able to compromise XXXX XXXX Geminis partner in providing consumers with an option to invest their self-directed retirement funds in cryptocurrency. Amazingly, Gemini had no safeguards against a single point of failure at XXXX  XXXX, where hacked administrative accounts were able to transfer tens of millions of dollars from hundreds of different individual customer accounts under their control into one account, and then transfer from the one account off the exchange, all within dozens of minutes. In statements to victims after this egregious security failure, Gemini has said The subject transactions appeared, from Geminis perspective, to be routine, authorized, and legitimate. This statement from Gemini is incredible and highlights the extreme lack of anything close to proper safeguards.

The standard for unfairness in the Dodd-Frank Act is that an act or practice is unfair when : ( 1 ) It causes or is likely to cause substantial injury to consumers ; ( 2 ) The injury is not reasonably avoidable by consumers ; and ( 3 ) The injury is not outweighed by countervailing benefits to consumers or to competition. See 15 U.S.C. 45 ( n ) ( The standard for unfairness in the Dodd-Frank Act has the same three-part test as the FTC Act, which was first stated in the FTC Policy Statement on Unfairness ( XXXX XXXX, XXXX ), available at : http : //www.ftc.govXXXX, and later specifically included in the FTC Act. ) As an example, in In re XXXX XXXX, XXXX XXXX, the Office of the Comptroller of the Currency ( OCC ) brought an enforcement action where a bank maintained deposit account relations with telemarketers and payment processors without adequately safeguarding against fraud. In that case, the telemarketers regularly deposited large numbers of remotely created checks drawn against consumers accounts, a large proportion of which were not authorized by consumers. OCCs investigation indicated the bank failed to establish appropriate policies and procedures to prevent, detect, or remedy such activities. Under the three-part test for unfairness, ( 1 ) the consumers lost money from the fraudulent checks was a substantial injury, ( 2 ) consumers could not have avoided the injury from transactions to which they had not consented, and ( 3 ) the cost to the bank of establishing a minimum level of due diligence, monitoring, and response procedures sufficient to remedy the problem would have been far less than the amount of injury to consumers that resulted from the banks avoiding those costs. See CFPB Consumer Laws and Regulations, UDAAPs Manual v.3 at pp.4-5 ( XX/XX/XXXX ) ( discussing the analysis ). 

Geminis failures in the present case easily meet the three-part test for unfairness. First, the lost tens of millions of dollars worth of crypto is obviously a substantial injury. Second, there is nothing the consumers could have done to avoid this injuryin fact, not only had the victims not consented to the transfers, but we relied on notifications and two-factor authentication to make any transfers on the Gemini exchange, and yet no notice was provided by Gemini at any time as the accounts were being drained. No protections were offered by Gemini and there was nothing consumers could have done, reasonable or otherwise, to prevent this. Third, as in In re XXXXXXXX XXXX XXXXXXXX XXXX, the cost to Gemini of establishing a minimum level of due diligence, monitoring, and response procedures sufficient to remedy the problem would have been far less than the injury resulting from Geminis avoiding these costs. In other words, Geminis failures were clearly unfair under the meaning of Dodd-Frank , and in accordance with precedent, and CFPB should take action to compel Gemini to restore the victims accounts.

II. Geminis Deceptive Acts and Practices : Misleading Claims and Omissions About Security and Insurance that Consumers Reasonably Relied Upon to their Detriment When I was looking for a platform I could use to invest my self-directed retirement funds in crypto, I picked XXXX  XXXX due to their advertised partnership with Gemini, which holds itself out as an industry leader in security and advertises that all crypto on its exchange is insured. Gemini got my business, and those of countless others no doubt, by promoting a reputation for safety and security. I, and other victims, reasonably relied on Geminis assurances that our assets were safe on the Gemini exchange, and we reasonably believed that, should they be somehow stolen or otherwise compromised, our assets would be protected by Geminis insurance. But all of this appears based on Geminis current position to be egregiously misleading. In other words, Geminis representations were extremely deceptive.

Under the Dodd-Frank Act, a representation, omission, act, or practice is deceptive when ( 1 ) The representation, omission, act, or practice misleads or is likely to mislead the consumer ; ( 2 ) The consumers interpretation of the representation, omission, act, or practice is reasonable under the circumstances; and ( 3 ) The misleading representation, omission, act, or practice is material. See CFPB Consumer Laws and Regulations, UDAAPs Manual v.3 at p. 5 ( XX/XX/XXXX ) ( citing FTC Policy Statement on Deception, available at http : //www.ftc.govXXXX XXXX 

CFPB has explained that, in addition to affirmative representations that are misleading, if material information is necessary to prevent a consumer from being misled, it may be deceptive to omit that information. Id. Examples of deceptive practices may include, among other things, offering to provide a product or service that is not in fact available ;... omitting material limitations or conditions from an offer ; or failing to provide the promised services. Id. 

Geminis acts and practices easily meet the test under Dodd-Frank because they lured consumers in with statements creating reasonable expectations for security and insurance, which proved to be totally false and which materially harmed the consumers who relied on these reasonable expectations. Below, I set forth some of the specific statements and representations made or omitted by Gemini, the reasonable expectations these created, and the reality of what occurred and what Gemini is saying now.

A. What Gemini Said : That They Are Safe, Trusted, Leaders in Security, and that Their Protections Include 2FA, Protections Against Single-Points of Failure , and Insurance Against Fraud Geminis entire sales pitch is that they are safe and secure, and that people should trust them to safeguard their valuable assets. Gemini tells the public they are the Safest Crypto Exchange, and make the following representations, among others : Trust is our product.

Geminis founders built Gemini to deliver the first trusted platform that focused on strong security controls and compliance. 
Gemini has built a leading security program focused on developing innovative security solutions to help protect and secure our customers and their assets. 
All crypto held online in our exchange wallet is insured and we use best-in-industry cold storage coverage with leading insurance providers. 

See Gemini Advertising and Marketing Materials, Exhibit A. 

Along the same lines, XXXX  XXXX distinguished itself in advertisements by stressing its partnership with Gemini and underscoring the safety, security, and insurance of the Gemini XXXX. XXXX  XXXX advertised about its partner and their collective products and services, among other things : Gemini is a regulated crypto exchange with over {$10.00} billion in assets. 
How it works... XXXX  XXXX creates your crypto account on Gemini. Gemini then emails you onboarding instructions. 
Gemini is a regulated trust company and offers its clients insurance against fraud. 

XXXX  XXXX XXXX and Marketing Materials, Exhibit B. 

Gemini participated in this partnership and at no time qualified or corrected any statements advertised about the safety, security, and insurance that would protect customers. 

Notably, I recall seeing and relying on similar communications and advertisements about the safety and security of Gemini ( and XXXX  XXXX as a result of their partnership with Gemini ), and I understand some materials have since been taken down by one or both companies. I do not have access to all of these, but I believe other victims may have some of these materials that they have provided or may provide to CFBP.

One stark example of this is Geminis prior claims about insurance, which has now been heavily qualified.

Geminis prior representation about insurance was : All crypto held online in our exchange wallet is insured and we use best-in-industry cold storage coverage with leading insurance providers.

As of the date of this letter, Gemini has taken this down, tacitly acknowledging its inaccuracy, and Gemini now represents to the public only that : We maintain insurance against certain types of crypto losses from our exchange wallet and from Gemini Custody. To learn more about our insurance, and what it does and does not cover, please visit our User Agreement.

See Exhibit A. 

In addition to these general promises, Gemini advertises specific details of their industry leading security that protect customers. Some particularly relevant representations include those concerning two-factor authentication and protections against single points of failure : In discussing its specific security practices, Gemini states that Two-Factor Authentication ( 2FA ) is required by default, in order to access your account and make withdrawals.

Similarly, Gemini toutes its asset security, stating The multisignature digital signature scheme ( multisig ) used eliminates single points of failure and improves our resilience against the loss or compromise of any individual private key.

It bears noting here that Gemini never corrected any statements advertised by XXXX  XXXX ( or itself ) about the security that would apply to holding retirement account assets on its exchange. In addition, none of the affirmative statements made above were qualified in any way that would communicate to a potential customer of the XXXX  XXXX XXXX Gemini partnership that investing retirement funds are any less protected than investing non-retirement funds. In fact, when onboarding through Gemini after singing up with XXXX  XXXX and Gemini, Gemini communicates the oppositethey sent victims welcome letters, reiterating promises of their security-first mentality and an ethos of asking for permission, not forgiveness, and they promised the full Gemini experience. 

B. What Victims Reasonably Understood and Expected : That Our Crypto Was Safe and Insured and that Gemini Would Not Allow Tens of Millions to Be Withdrawn From Our Accounts Without Our Permission or Even Notification, Among other Reasonable Expectations All these statements of assurance and trust workedI and other victims believed Gemini ( and purchased their product ). I and other victims came to the expectation and belief that our crypto was safe from fraud on Geminis exchange, and that in the event anything did happen, Gemini protected our crypto with insurance so there was no appreciable risk of catastrophe. The entire point of selecting XXXX XXXX and Gemini as a place to hold valuable retirement assets was the promised security, safety, and insurance. 

Specific beliefs reasonably held as a result of Geminis representations included that no crypto would be withdrawn from victims accounts without consent via 2FA, that Gemini had adequate protections in place to prevent catastrophic loss from a single-point-of failure, and that in any event our assets were protected against fraudulent withdrawals by Geminis insurance coverage. These beliefs and expectations were eminently reasonable based on the statements above.

For example, the statement that Geminis security eliminates single points of failure communicates to consumers that we can trust there are multiple layers of security protecting our assets, so that there is no risk of one compromise causing catastrophic loss.

Geminis statement that 2FA is required to make withdrawals gave us the expectation that our accounts would not be able to be drained without our consent or knowledge. My expectations and beliefs on this were also reinforced along the way, including by Geminis requirement for 2FA anytime I executed any transaction on Geminis platform. 

This misrepresentation is particularly egregious given Geminis direct communications to us that they founded Gemini with a security-first mentality and an ethos of asking for permission, not forgiveness. We reasonably expected that they would not allow tens of millions in retirement assets to be withdrawn from our accounts without our permission. This expectation was more than reasonable given their explicit statement that 2FA was required for withdrawals and subsequent practice of asking our permission via 2FA for any buy or trade prior. Not only did they fail to ask for our permission, now they are not even asking our forgivenessto date they have taken zero responsibility for allowing our retirement funds to be funneled off the safest crypto exchange. 

Geminis unqualified statement that all crypto on their exchange is insured gave us all confidence that, should anything happen, there is insurance available to cover loss. This was advertised by both Gemini and XXXX XXXX, and a material inducement for us to give them business. Given these broad, unqualified statements, it was reasonable for customers to expect that Gemini would in fact cover crypto with insurance against loss if their security practices failed to prevent the loss, as was the case here. 

As to the rest of my expectations around security and insurance, at no time did I have any reason to question any of the representations and promises initially made that I relied upon in signing up with XXXX XXXX and Gemini. 

C. What Actually Happened and What Gemini Now Says About it On XX/XX/XXXX, XXXX  XXXX was hacked. Hackers gained control of XXXX  XXXX administrator accounts, transferred tens of millions of dollars worth of assets from hundreds of victims to one account, created a new external wallet, and transferred the assets off Gemini exchange without notifying victims or apparently raising any flags at Gemini whatsoever. In fact, Gemini told victims The subject transactions appeared, from XXXX perspective, to be routine, authorized, and legitimate. Gemini XX/XX/XXXX Response to Victim CFPB Claim, Exhibit C. As presented to Gemini, these actions satisfied all of Geminis transaction approval requirements and appeared to be authorized transactions made from XXXX  XXXX known and approved devices. Gemini XX/XX/XXXX Response to EFTA Notice, Exhibit D. Further, Gemini has stated their insurance does not cover the loss because Geminis systems were not compromised.

In other words, the expectations we reasonably held based on Geminis representations proved dramatically false : Our expectation that Gemini was a safe, secure, trustworthy place to store crypto was eviscerated by their total failure to prevent bad actors from summarily and fraudulently transferring tens of millions of dollars worth of assets off the exchange. 
Our expectation that Gemini would notify us with 2FA and ask permission to withdraw funds proved shockingly false as we heard nothing from Gemini while they allowed our funds to be drained.

Our expectation that their security included multiple layers to protect against single-points of failure such as the hack of an administrator with the power to create new external wallets and transfer off assets without safeguards proved similarly false.

Finally, our expectation that Gemini maintained insurance that would protect our crypto as a fail-safe in case there was a dramatic unexpected breach also proved false. 

D. Clear Violation of Standard under XXXX XXXX These misrepresentations easily meet the test for deceptive under the Dodd-Frank Act. First, they are likely to mislead customers. As noted, the whole point of the advertising is to garner trust in Geminis security and get customers to buy their product. Second, as explained above, believing these representations under the circumstances is reasonable. Customers had no reason to question what Gemini and XXXX  XXXX were selling until the catastrophic failures came to light. Finally, the representations were material. The entire reason I ( and others, presumably ) chose Gemini was for the advertised safety and security. 

It is critical to note that, even if all of Geminis claims were technically accurate ( for example, if their 2FA applied to XXXX  XXXX and not the consumer, and if the coins were insured just not against this type of fraud ), these claims remain highly misleading and illegal under XXXX XXXX I was led to believe, as any reasonable consumer would be through these claims, that my crypto was safethat it would not be withdrawn without my own 2FA ( which was required for purchases and transfers ) ; that Geminis systems were not susceptible to single-point of failure attacks ( including, what a reasonable consumer would think constitutes single-point of failurethe hack of Geminis partner administrator ) ; and that in any event, my crypto was protected via Geminis touted insurance policy. All of these beliefs turned out to be false and inaccurate, and yet they are totally reasonable and foreseeable based on Geminis advertising, representations, communications, acts, and practices. These misrepresentations were hugely materialthe trust was the foundation of my ( and other customers ) decision to go with Gemini. In no event would any of us have considered putting our retirement assets on the Gemini exchange had we known that our assets were not in fact protected in the way Gemini led us to believe they would be. 

In other words, whether or not Gemini technically provided all the security they advertised, the fact remains that it was totally inadequate to prevent massive, foreseeable fraud, and this was shocking to customers who reasonably relied on their statements to believe that Gemini would be able to prevent, or at minimum insure loss from, such massive fraud. 

III. Geminis Violations of State and Federal Law In addition the the violations outlined above, violations of applicable state and federal law also constitute UDAAPs, enforceable as violations under Dodd-Frank.

A few noteworthy violations of applicable New York state law include : Gemini was required to conduct risk-assessment of XXXX XXXX platform and evaluate the adequacy of XXXX XXXX cybersecurity practices and protections under 23 NYCRR 500.11 . Gemini failed to do this. This is particularly egregious since Gemini now points to the breach at XXXX  XXXX and says Gemini holds no responsibility, putting all of the weight of responsibility on a security link that they themselves did not evaluate, in contravention of state law. 

Gemini was required to provide its telephone number for the receipt of complaints under 23 NYCRR 200.20 ( b ) ( 1 ), but had only provided XXXX XXXX with its email address. This violation resulted in delays and significant loss after XXXX  XXXX detected the ongoing theft and Gemini was unresponsive to initial email notifications, with no ability to immediately notify Gemini. 

Geminis false, misleading, and deceptive representations and omissions, discussed above, are violations of New York law on advertising and marketing, 23 NYCRR 200.18. Gemini claims that its unqualified advertising that all crypto held on its exchange are insured was modified by language buried in its user agreement. However, as discussed above, even if this is technically true, the unqualified advertisement was highly misleading and deceptive, and itself is false without the separate qualification. Similarly, as discussed above, Geminis advertisements and representations that 2FA was required for withdrawals was misleading, deceptive, and ultimately false. 

Gemini was required to implement adequate anti-money laundering measures and protections under 23 NYCRR 200.15 ( b ), ( c ). Criminals were able to steal assets from hundreds of accounts, transfer those assets ( one coin at a time ) to a single, unrelated account and then remove the stolen assets to a money-laundering tornado, thereby hiding the identity/ownership of the assets. This criminal laundering scheme involved several hundred transfers that went completely undetected by Gemini, in violation of New York anti-money laundering law. 

Similarly, Gemini was required to monitor its system for transactions that might signify money laundering, tax evasion, or other illegal or criminal activity. 23 NYCRR 200.15 ( e ) ( 3 ). Gemini did not monitor for such activity here, as evidenced by the fact that it permitted hundreds of illegal transfers to occur, one coin at a time, into a single, unrelated account having no connection to its customers XXXX  accounts, and then allowed all of the stolen assets to be removed from its exchange. Subsequently, Gemini stated The subject transactions appeared, from Geminis perspective, to be routine, authorized, and legitimate. 

Critically, Gemini was also required to maintain, as part of its anti-money laundering program, a customer identification program. 23 NYCRR 200.15 ( h ). As part of this, Gemini was required to verify the identity of any accountholder initiating a transaction with a value greater than {$3000.00}. Here, as discussed above, Gemini did not verify the identity of the hundreds of customers via 2FA or otherwise of the withdrawals of hundreds of millions of dollars worth of crypto via voluminous transactions, all over {$3000.00} in value.

Gemini further failed to have in place appropriate policies and procedures to block or reject specific or impermissible transactions that violate Federal or State laws, rules, or regulations in violation of 23 NYCRR 200.15 ( j ). As discussed above, Geminis failures to monitor for, flag, or notify customers of hundreds of millions of dollars worth of crypto being fraudulently transferred to one account then to a new external wallet off exchange and into the abyss was an egregious failure.

Gemini also violated Californias Unfair Competition Law, Cal. Bus. Prof. Code 17200 et seq., which prohibits unfair business practices, including misleading advertising, similar to the federal violations of XXXX discussed above. Geminis unfair and misleading business practices were violations of state law in California because Gemini advertised its services here in California where I and other California victims reside, and Gemini got my business and that of other California victims, who all suffered a loss as a result of these practices.

Gemini may also have violated the Electronic Funds Transfer Act. I provided Gemini with notice of unauthorized transfer and requested correction under Regulation E. Gemini responded that Regulation E did not apply to the unauthorized transfer from my Gemini account because the account was a retirement account. It is unclear to me whether this is accuratethe exemption from retirement accounts appears to be focused on exempting the entity complying with IRS retirement obligations, which in this case would be XXXX  XXXX. It is not clear that the exemption would apply to Gemini, who is not regulated as a custodian. Thus, it appears Gemini may also have violated the EFTA. See EFTA Correspondence, Exhibit E.

IV. Conclusion and Request for Remedy Geminis promises of security, notifications, insurance, and trust succeeded in getting the business of hundreds of victims that put tens of millions of dollars of critically important retirement funds on Geminis exchange and trusted Gemini to deliver on its promises, including to ask permission not forgiveness. Yet we found out Gemini failed us dramatically by allowing thieves to fraudulently transfer our retirement savings to one account, create an external wallet, and transfer our savings off Geminis exchange, without so much as notifying us, much less performing any of the promised or required verifications. Gemini did not even flag this as unusual, but instead told victims The subject transactions appeared, from Geminis perspective, to be routine, authorized, and legitimate. And they say it was not insured after all. 

This is an outrageous failure on so many levels. The violations of XXXX are stark and numerous, as set forth above. We were misled by Gemini into buying the trust they were selling. But in the end, they did not protect our assets, and they are not putting the force of their company behind their initial promises of security and insuranceinstead it appears they are putting the force of their company toward gearing up to defend claims and making all the hundreds of victims pay out of pocket to hire private attorneys to enforce their clear rights. It is reprehensible. 

I am asking the CFPB to enforce XXXX and require Gemini to make the victims wholespecifically to reimburse victims in-kind for all of the crypto that was allowed to be transferred fraudulently off Geminis exchange, and to reimburse victims for any attorney fees and other costs actually incurred as a result. If CFPB has the power and inclination, I also request further penalties to be issues and further compensation to victims to be paid for their non-monetary damages, including the severe mental stress and emotional turmoil it has had on their lives as theyve dealt with drained retirement accounts and an about-face from the company that promised trust and security. 


Thank you for your immediate care and attention to this matter. 

Sincerely,