This past week, co-defendants in a class action related to the theft of cryptocurrency engaged in their own lawsuit over alleged security failures.  IRA Financial Trust, a retirement account provider offering crypto-assets, sued class action co-defendant Gemini Trust Company, LLC, a crypto-asset exchange owned by the Winklevoss twins, following a breach of IRA customer accounts.  IRA claims that Gemini failed to secure a “master key” to IRA’s accounts, and that hackers were able to exploit this alleged security flaw to steal tens of millions of dollars of cryptocurrency.  This lawsuit demonstrates the growing trend of cryptocurrency thefts resulting from cyber breaches, and ensuing litigation activity.

IRA Financial Trust v. Gemini Trust Company, LLC, 1:22-cv-04672 (S.D.N.Y. June 6, 2022), stems from an alleged cyber incident in February 2022.  IRA provides self-directed retirement accounts, and in 2019 began allowing its customers to include crypto assets in such accounts.  To supply these services, IRA employed Gemini’s crypto exchange service to manage the trading and custody of its customers’ crypto assets.  Following a response by SWAT officers to IRA’s offices in Sioux Falls, South Dakota in response to a purported kidnapping, IRA claims that it discovered cryptocurrency was being transferred within the Gemini program from other IRA customer accounts into one single account, and that roughly $37 million of bitcoin and Ether assets were subsequently transferred out of that account by the hackers.  IRA alleges that this hack resulted from insufficient protection of a “master key” to IRA’s accounts, and avers in its fraud claim that Gemini made misleading statements about their commitment to cybersecurity that induced IRA to select Gemini as a partner.

IRA and Gemini are co-defendants in a class action lawsuit filed in the Northern District of California in March of this year by a plaintiff purporting to represent customers who claim to have lost the cryptocurrency held in their retirement accounts as a result of this alleged breach.  Griffin v. Gemini Trust Co., LLC and IRA Financial Trust Co., 3:22-cv-01747 (N.D.C.A. March 18, 2022).  In that action, Gemini responded with a motion to compel arbitration. While litigation related to cybersecurity incidents, including class actions, have become increasingly common, the rise in the number and sophistication of cyber theft from businesses associated with the trading and holding of crypto assets is likely to result in increasing litigation activity in this space.