Some Gemini customers have recently been the target of phishing campaigns that we believe are the result of an incident at a third-party vendor. This incident led to the collection of Gemini customer email addresses and partial phone numbers. __No Gemini account information or systems were impacted__ as a result of this third-party incident, and all funds and customer accounts remain secure.

In light of these increased phishing campaigns, we are sharing security best practices with our customers.

### At Gemini, the security of customer funds and accounts is our top priority. 

We do not recommend that you rely on the secrecy of an email address as a substitute for strong authentication methods. However, if you would like to [reset the email](https://support.gemini.com/hc/en-us/articles/115005755526-How-do-I-change-my-email-address-) associated with your Gemini account, here are instructions on how to do so:

1. Login to your account via the web browser (currently not available on the mobile app) and go to [https://exchange.gemini.com/settings/security](https://exchange.gemini.com/settings/security);
2. Click "Security Options" on the right-hand corner (next to your current email address);
3. Select "Change Email" from the drop-down menu; and
4. When prompted, enter your new email and current Gemini password.

[Online scams are common](https://www.gemini.com/blog/common-online-scams-and-how-to-avoid-them), particularly in the crypto industry, and we highly recommend using two-factor authentication (2FA) and/or hardware security keys to protect your Gemini account. 

We invite you to visit the links below to learn more about how you can keep your account safe:

- [How to use 2FA](https://support.gemini.com/hc/en-us/articles/115005755506-How-do-I-use-2FA-with-my-new-phone-device-number-) 
- [How to set up a hardware security key](https://www.gemini.com/blog/keep-yourself-and-your-cryptos-secure-with-one-simple-step) | [YubiKey](https://www.yubico.com/products/) | [Google Titan Key](https://cloud.google.com/titan-security-key)

Online scammers have become increasingly sophisticated. Remaining vigilant so you can quickly catch phishing warning signs is crucial for your overall online security.  

Gemini Product Security Team

Protecting Our Customers From Phishing Campaigns

From day one, Gemini has prioritized the security of our customers’ assets. We never have and never will compromise on that point. As the crypto ecosystem emerges from infancy into adolescence we are more confident than ever that *__asking for permission, not for forgiveness__* will continue to be the central pillar of how we run our business. 

It has been a tough couple of days for our industry. Our hearts go out to all those impacted by recent events at FTX. We are all working together to build a brighter future and moments like these are painful.

For the avoidance of doubt, __Gemini has no exposure to FTT tokens or Alameda and no material exposure to FTX__.

### Gemini is a Full-Reserve Exchange and Custodian

Gemini is a full-reserve exchange and custodian. This means that __all customer funds held on Gemini are held 1:1 and available for withdrawal at any time.__ 

Gemini holds customer fiat currency in accounts that are segregated from our business, operating, and reserve bank accounts established specifically for the benefit of Gemini customers. __We do not do anything with your fiat funds unless explicitly authorized and directed to do so by you.__

Gemini holds customer digital assets in accounts that are segregated from our assets. __We do not do anything with your digital assets unless explicitly authorized and directed to do so by you.__

In addition to being a full-reserve platform, Gemini Trust Company, LLC is a fiduciary and qualified custodian under New York Banking Law and is licensed by the New York State Department of Financial Services (NYDFS). NYDFS imposes certain excess capital requirements and compliance standards for all assets held on Gemini. __At any given time, Gemini is required to hold capital in excess of customer deposits and must report any material changes in this capital to its regulator.__

### Gemini is Highly Regulated

Since its inception eight years ago, Gemini has worked with regulatory stakeholders and lawmakers to help shape thoughtful regulation that fosters both consumer protection and innovation. We will continue to do this work. We have spent considerable time applying for and becoming licensed and regulated in various jurisdictions across the world. This is not the easier path (it is expensive and time consuming) but we believe it is the right one.

Gemini holds many licenses globally, including a New York trust license, state money transmitter licenses (or the statutory equivalent), an E-Money License from the Financial Conduct Authority in the UK, an E-Money License from the Central Bank of Ireland, and more.

Related to our licenses, Gemini must undergo annual audits of our financial statements and is subject to bank examinations conducted by NYDFS. We are also [SOC 1 and SOC 2 compliant](https://www.gemini.com/blog/gemini-completes-soc-1-type-2-and-soc-2-type-2-examinations-leading-crypto).

Ten years ago, we bought our first bitcoin on Mt. Gox. Those Wild West days informed us with regard to what needed to change. We built Gemini to be this change. We look forward to working with everyone in our industry to continue to build trust in this new magical frontier and unlock its ultimate promise.

Onward and Upward.

Cameron and Tyler

Gemini Is Built on Trust, Safety, and Compliance: Ask For Permission, Not For Forgiveness

October is Cybersecurity Awareness Month, and we’re excited to continue outlining various security features and tips that can protect your account and funds at Gemini. Over the past weeks, we’ve discussed best practices for [securely logging on to your account](https://www.gemini.com/blog/logging-on-to-gemini-safely-two-factor-authentication) as well as [security features that help keep you safe while you trade](https://www.gemini.com/blog/trading-crypto-securely-on-gemini). 

Today, we’re breaking down best practices for withdrawing your crypto from Gemini. Whether you want to send crypto to a family member or use your crypto across the decentralized finance (DeFi) ecosystem, there are security features on Gemini and general tips to keep in mind when moving your crypto off our platform. To start, you need to know __your recipient’s exact wallet address__ and you must be sure that __the target wallet address is compatible with the cryptocurrency that you’re sending__. 

__Build Your List of Approved Wallet Addresses__

To securely send your crypto from Gemini to another wallet, we recommend you start by building a list of approved wallet addresses. While this security feature is optional, building a list of approved wallet addresses can provide additional confidence that your crypto is being sent to your intended recipient and additional protection in the event your account is compromised.

Once you enable approved addresses, you’ll only be able to send funds to addresses on your approved address list. Keep in mind that any time you add a new wallet address to your approved address list, __a 7-day approval period delay__ will be triggered. This gives you time to double (or triple) check that you’ve entered the correct address and delete any erroneous addresses. If you enable approved addresses and leave the list empty, you effectively block all crypto withdrawals from your account, which can provide extra peace of mind if your strategy is to “[HODL](https://www.gemini.com/cryptopedia/search?query=HODL).”

You can [learn more about approved addresses](https://support.gemini.com/hc/articles/360001411543-What-is-an-Approved-Address-) and how to [add one here](https://support.gemini.com/hc/articles/360027564891-How-do-I-add-an-approved-address-). Visit the following link to find and [configure approved addresses](https://exchange.gemini.com/signin?redirect=9b85d3883b18d26b2c652157af48c90852fd6d09-1634658166096-%2Fsettings%2FapprovedAddresses) in your account settings. 

__Blockchain Networks Supported by Gemini__

At Gemini, as we’ve continued to support more tokens for trading, we’ve expanded our blockchain compatibility to a number of networks beyond [Bitcoin](https://www.gemini.com/prices/bitcoin), including [Ethereum](https://www.gemini.com/prices/ether), [Dogecoin](https://www.gemini.com/prices/dogecoin), [Zcash](https://www.gemini.com/prices/zcash), and [Filecoin](https://www.gemini.com/prices/filecoin). However, we currently do not support sending tokens to chains like Polygon or Binance Chain. If you send tokens to unsupported networks, they will be unrecoverable, so please be extra careful that your target wallet is compatible with the token you’re sending as well as the network you’re sending it on. 

Here’s a list of [blockchain networks compatible with Gemini](https://support.gemini.com/hc/en-us/articles/4408420583835-What-networks-are-supported-for-Crypto-Deposits-and-Withdrawals-on-Gemini-):

- [Bitcoin (BTC)](https://www.gemini.com/prices/bitcoin)
- [Ethereum (ETH)](https://www.gemini.com/prices/ether)
- [Litecoin (LTC)](https://www.gemini.com/prices/litecoin)
- [Bitcoin Cash (BCH)](https://www.gemini.com/prices/bitcoin-cash)
- [Zcash (ZEC)](https://www.gemini.com/prices/zcash)
- [Filecoin (FIL)](https://www.gemini.com/prices/filecoin)
- [Dogecoin (DOGE)](https://www.gemini.com/prices/dogecoin)
- [Tezos (XTZ)](https://www.gemini.com/prices/tezos)
- [Solana (SOL)](https://www.gemini.com/prices/solana)

Keep in mind that while we support the ERC-20 versions of [Polygon](https://www.gemini.com/prices/polygon) (MATIC), [Fantom](https://www.gemini.com/prices/fantom-ethereum) (FTM), [Mirror](https://www.gemini.com/prices/mirror-ethereum) (MIR), [Terra](https://www.gemini.com/prices/terra-ethereum) (LUNA), and [TerraUSD](https://www.gemini.com/prices/terrausd-ethereum) (UST), we do not support the native versions of these tokens yet. When purchased on Gemini, ERC-20 tokens can be withdrawn to an Ethereum-compatible wallet for use across the DeFi ecosystem, but you’ll need to use a [bridge](https://www.gemini.com/cryptopedia/search?query=Bridge) if you want to withdraw these tokens to their native chains. If you withdraw the ERC-20 version of these tokens to a wallet associated with their native chains, without first bridging them from the Ethereum network, they may be unrecoverable. 

We are thrilled to provide you with these cybersecurity tips and tools, and throughout the rest of October, we’ll continue to highlight important features and tips that can help you stay safe online. This Cybersecurity Awareness Month, “Do Your Part. #BeCyberSmart!”

Onward and Upward!

Team Gemini

*Updated: May 16, 2022*

Gemini uses state of the art security to store your crypto and allow you to withdraw crypto seamlessly and securely.

Store and withdraw your Crypto safely with Gemini

Securely Withdrawing Your Crypto From Gemini

At Gemini, __the security of your account and funds is central to our mission__. In honor of Cybersecurity Awareness Month, we have outlined some steps you can take, and measures we have in place, to help keep your crypto secure throughout your Gemini journey. 

[As we outlined earlier this month](https://www.gemini.com/blog/logging-on-to-gemini-safely-two-factor-authentication), there are a number of actions you can take to protect your Gemini account — most notably, employing additional authentication methods like [two-factor authentication (2FA)](https://www.gemini.com/blog/keep-yourself-and-your-cryptos-secure-with-one-simple-step). Behind the scenes, however, there are __further security measures we have in place to help keep your account and funds safe__.

__Using Verified Devices to Access Your Gemini Account__

Whenever you sign on from a new device, we’ll prompt you to verify your device. Device verification allows us to match your account to the devices you use most often, providing an extra level of confidence that you are the individual accessing your account. Keep in mind that this verification feature may also be triggered when you sign on to Gemini from a new or updated browser. 

When this occurs, you’ll receive an email from us asking if you just signed on from a new device. If you did not just attempt to sign on from a new device, a timely click of a link within the email will immediately place a hold on your account, keeping that malicious actor locked out and prevented from trading or withdrawing funds.

__Password and Email Changes Trigger an Account Pause__

Another security feature we’ve integrated into our systems is a withdrawal hold on your account for at least 24 hours when you change an email address or password. Visit our Cryptopedia platform to learn more about [password best practices](https://www.gemini.com/cryptopedia/how-secure-is-your-password-protection). 

A commonly used tactic by [attackers who compromise accounts](https://www.gemini.com/cryptopedia/account-takeover-attack-meaning-and-protection) on web applications is to change the account information to lock the user out of their account. At Gemini, should your password or email address change, we’ll automatically block withdrawals on your account for at least 24 hours. In the event your account is compromised, this feature protects your funds by giving you a reasonable opportunity to take action and freeze your account.

Together with preventative measures like the use of two-factor authentication methods, including hardware security keys, these safeguards provide extra protection for your Gemini account. This is just a glimpse of the [security features](https://www.gemini.com/security) we have in place, and our security teams are committed to remaining ahead of the curve when assessing potential threats across our systems. 

Over the next couple weeks we’ll continue to provide you with information on the robust security measures we have in place to protect your crypto. This Cybersecurity Awareness Month, “Do Your Part. #BeCyberSmart!”

Onward and Upward!

Team Gemini

Trading Crypto Securely on Gemini

October is [Cybersecurity Awareness Month](https://www.cisa.gov/cybersecurity-awareness-month), which is an opportunity to share best practices for staying safe online. Over the next four weeks we’ll walk you through some steps you can take, as well as the safeguards we have in place, to secure your crypto from the time you log on to Gemini until you sign off. 

Our primary focus at Gemini is ensuring your crypto remains secure, and the most impactful step you can take is to __protect your login credentials__. Keeping your Gemini credentials safe and private is the first line of defense against being a victim of [an account takeover](https://www.gemini.com/cryptopedia/account-takeover-attack-meaning-and-protection#section-how-to-prevent-account-takeover-fraud).

__Use Two-Factor Authentication to Protect Your Account__

As a Gemini user you’ll be required to set up __two-factor authentication (2FA)__ on your account, providing you with an extra layer of security should your username and password be compromised. With 2FA set up on your account, you’ll be prompted to take an additional action alongside entering your password when you log in. This additional action can be 1) a one-time passcode that is generated by an authenticator app, 2) a one-time passcode delivered via an SMS message, or 3) a simple tap of a hardware security key like a [YubiKey](https://www.yubico.com/products/).

2FA has become a widespread security best practice in the cryptocurrency industry providing an important second layer of protection beyond your password. [Set up your 2FA](https://support.gemini.com/hc/articles/360038849612-Authy-Overview-and-Setup) by connecting your phone number or downloading an authenticator app, such as __Authy__, __Duo__, or __Google Authenticator__, which you then connect to your account via a QR code. __We recommend you use an authenticator app__, which secures your account against SIM swaps and is more secure than receiving a 2FA code via phone message. [Learn more about 2FA on Cryptopedia](https://www.gemini.com/cryptopedia/how-secure-is-your-password-protection#section-medium-level-password-security). 

__Strengthen Your Account Security With Hardware Security Keys__

To really boost your online security, you can use a hardware security key, such as [YubiKey](https://www.yubico.com/products/?utm_source=Gemini-blog-oct15) or [Google’s Titan Key](https://cloud.google.com/titan-security-key), for all your important online accounts, including Gemini.

A hardware security key not only protects you in the event of your password being compromised but also uses some clever design and mathematics to ensure that __your security key second factor is__ “[__unphishable__](https://www.gemini.com/cryptopedia/phishing-attacks-explanation-safety-guide).” It provides the strongest level of protection by delivering hardware-backed, cryptographic proof of your identity, ensuring that only you, the holder of the physical hardware key, can gain access to your account — even if an attacker has compromised your password or successfully executed a [SIM swap](https://www.gemini.com/cryptopedia/sim-swap-attack-preventing-crypto-fraud) on your mobile device.

To keep user accounts secure we use [The Web Authentication standard](https://webauthn.guide/), a top standard of hardware security key authentication for web applications. For more information, __check out this step-by-step process for__ [__setting up and using a hardware security key__](https://www.gemini.com/blog/keep-yourself-and-your-cryptos-secure-with-one-simple-step) to secure your Gemini account. 

In the weeks to come, we will provide you with a number of other security measures to help you stay safe online. This Cybersecurity Awareness Month, “Do Your Part. #BeCyberSmart!”

Onward and Upward!

Team Gemini

Logging On to Gemini Safely: Two-Factor Authentication

Today, we are proud to announce that Gemini has [joined the Take Five Charter](https://getstarted.gemini.com/take5/) in the UK alongside other leading financial institutions, banks, and fintechs. Led by UK Finance and backed by Her Majesty's Government, the campaign offers straightforward and impartial advice to help protect UK customers from financial fraud and scams. 

[Take Five](https://takefive-stopfraud.org.uk/) encourages customers to take several steps to consider if a certain situation is genuine or feels like a scam, including:

- __STOP__: Taking a moment to stop and think before parting with your money or information could keep you safe.
- __CHALLENGE__: Could it be fake? It’s ok to reject, refuse, or ignore any requests. Only criminals will try to rush or panic you.
- __PROTECT__: Contact your bank or financial institution immediately if you think you’ve fallen for a scam and report it to Action Fraud.

As one of the very few UK companies approved as a cryptoasset firm under the Money Laundering Regulations, Gemini’s Financial Crime program is subject to oversight and enforcement by the Financial Conduct Authority (FCA). 

To help identify potentially fraudulent situations, we recommend you visit the [Take Five website](https://takefive-stopfraud.org.uk/) to familiarise yourself with the most common types of online criminal activity and practical advice to protect yourself, your family, and your friends against online fraud. The site includes useful tips on how to spot a cryptocurrency scam, which can range from online advertisements to incentive marketing techniques via email and social media where consumers are pressured to buy crypto before a deadline. 

At Gemini, customer safety is our priority and we are committed to providing education, understanding, and robust internal controls to facilitate a safe and trusted trading environment for our customers.

Onward and Upward.

Blair Halliday  
Head of Gemini UK

Gemini Supports the UK’s Take Five to Stop Fraud Campaign

This week we saw an increase in the number and frequency of account takeover attacks (commonly referred to as ATOs) against Nifty Gateway’s users. To be clear, the Nifty Gateway platform remains secure. We would, however, like to use this moment as an opportunity to raise awareness about ATOs within the NFT community. 

The following guidance highlights the steps members of our community can take to protect their accounts and shares some of the security features we’ve deployed on Nifty Gateway. 

__How exactly do ATOs of online accounts occur?__ 

An ATO occurs when an attacker obtains a user's valid email and password, often by breaching other unrelated services and then trying the same email and password combination across a variety of sites, including Nifty Gateway. Therefore, it is important to practice good security hygiene by *__never__* reusing the same password for more than one service. This means that the password you use for Nifty Gateway should be unique and not used for any other service.

__How can you prevent ATOs?__

In addition to never reusing a password, you should *__always__* enable two-factor authentication (2FA) on Nifty Gateway and any other service you use. Our customers can reference our website for instructions on how to [enable two-factor authentication](https://help.niftygateway.com/2020/08/05/guide-to-two-factor-authentication-on-nifty-gateway/). 

We have also deployed improvements to our platform to further mitigate similar attacks. The most impactful change we made is prompting users to perform email verification before performing sensitive account actions.

In the coming weeks and months, the team plans to roll out further enhancements to help mitigate the impact of ATOs. This includes mandatory 2FA for high risk accounts, additional controls to mitigate potential misuse, and continued focus on raising awareness around account security in the NFT community.

We also recommend users avoid negotiating trades outside of the official Nifty Gateway marketplace. Transactions occurring off-platform present significant counterparty risk and lack the security controls offered by the Nifty Gateway marketplace.

Our goal is to help educate all our users and engage our community wherever you may be on your security journey. We will continue to increase awareness of security best practices, including the risks of password reuse, and the importance of 2FA to the Nifty Gateway community. Coupled with the new controls that are planned, we’re excited to continue to make the platform even stronger for all our users. 

Onward and Upward,

Duncan and Griffin Cock Foster  
Nifty Gateway Co-Founders

Protecting Yourself Against Account Takeovers on Nifty Gateway

In modern organizations, third-party risk is always present. It’s nearly impossible to avoid, and challenging to detect and mitigate. We wanted to share a few details around a recent occurrence at Gemini that highlights the opaque nature of third-party risk and underscores the importance of cross-team and cross-company collaboration.

What is third-party risk? Simply put, it is the additional attack surface created by the use of software and services not owned by your company. Does your code include dependencies that your developers didn't write? That's third-party risk. How many SaaS products do your HR and recruiting teams use? That's third-party risk.

Third-party risk is often seen as just a part of doing business, because it is. You would be hard-pressed to find companies that build their own custom recruiting software purely for internal use. That's because integrating third-party products, despite the cost of the service and increased risk, still outweighs the time, money, and effort required to create and maintain the "wheel" you've just reinvented.

So, if third-party risk is a necessary evil in order to do business in 2021, how do you get a handle on it? At Gemini, we determine the inherent risk of third-party service providers and group them into tiers based on our Procurement and Vendor Management Policy. Gemini assesses certain tiers of vendors through a risk assessment process that may include review of relevant certification documents, questionnaires, and technical reports. The ultimate goal is to understand any potential risks and if or how they can be mitigated.

Detecting actual threats and truly understanding risk can be challenging. As we will explain, sometimes when it comes to third-party risk, more than three are invited to the party. Here we discuss how Gemini collaborated with multiple internal and external parties to detect, identify, and quickly resolve a recent issue.

__Detecting and Assessing the Threat__

It started with a bug report that came in through our private bug bounty program. In the submission, the researcher reported they had found a “[Blind XSS](https://portswigger.net/burp/releases/professional-1-6-33)” that disclosed a Zendesk administrator’s Authorization token.

As we began triaging the report, we noticed several interesting details:

- The proof of concept provided by the researcher did not include a cross-site scripting ([XSS](https://owasp.org/www-community/attacks/xss/)) payload, just an HTML *img* tag with a [Burp Collaborator](https://portswigger.net/blog/introducing-burp-collaborator) URL as the *src* attribute.
- The [same-origin policy](https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy) would prevent the user viewing the payload from sending the Authorization header in the request to fetch the image.
- The User-Agent in the request was ‘python-requests/2.22.0’. 

We quickly realized that this wasn’t a blind XSS, it was a [blind SSRF](https://portswigger.net/web-security/ssrf/blind)! We attempted to reproduce the issue following the steps provided by the researcher but were initially unsuccessful.

We contacted the researcher and worked closely with them while we continued attempting to reproduce the issue. Internally, we notified our Threat Detection and Response (TDR) team to help coordinate communication and attempt to determine if the issue had been exploited by any malicious parties. The Customer Support (CS) team was also notified to provide expertise and administrative access to our Zendesk account.

About 30 minutes after initially attempting to reproduce the issue we received a response from our earlier testing. Sure enough it contained what appeared to be an Authorization token. The good news was that we were able to reproduce the reported issue, but why was there such a long delay? 

__Working With External Partners__

After determining that the token contained in the response was a Zendesk OAuth token we quickly disabled it — just in case the token had been accessed by anyone other than the researcher we were working with. We were also able to identify the owner of the token; a Zendesk integration partner. Our CS team explained that they use this integration to help track their performance within Zendesk.

Out of an abundance of caution, we immediately disabled the Zendesk partner integration and contacted the partner’s security team. The team promptly responded and quickly set a time to meet and discuss the details. We had a productive and efficient call, and within hours a fix had been rolled out. We also continued to communicate with the researcher who originally reported the issue. 

__Due Diligence and Root Cause Analysis__

Once the fix was in place, we took a step back to better understand the issue. Based on discussions with the partner’s security team, our CS team, and a bit of research, we learned exactly how the issue presented itself. To put it succinctly, it was a flaw in a third-party integration to a third-party service used by Gemini.

Every 30 minutes or so, the service would authenticate to Gemini’s Zendesk instance to read and parse any new support tickets. During the parsing process, the service would fetch URLs, images and other assets that appeared in the ticket. The problem was, the “Authorization” header was set for not only authenticated assets, but anything that required an HTTP request, such as an image. As a result, an attacker could obtain the token by creating a support ticket with an image hosted on a server they controlled. When the service attempted to fetch the image from the attacker-controlled server, it would set the HTTP Authorization header with the Authorization token, which the attacker could capture in their web server logs.

We continued to work closely with the partner’s security team as well as Zendesk in order to determine the entire scope of the leak. We obtained logs from multiple sources both external and internal. We also worked closely with our TDR and CS teams to determine how the access token was used and if any customer data was exposed. We were able to determine conclusively that the issue had not been exploited by anyone except for the researcher who originally notified us. At this point, we were comfortable re-enabling the Zendesk partner integration so our CS team could continue to use the service. 

Third-party risk will often present itself in unexpected ways. It is not feasible to attempt to mitigate every eventuality. Be prepared for the unexpected, rely on your internal teams, hope for the best with external partners, and “reduce the blast radius” whenever possible.

While the root cause of this issue was not technically complicated, the multiple degrees of separation and the number of internal and external teams involved made for a challenging triage and response process. Despite this challenge, and with the help of some truly excellent external partners, this issue came to an efficient and safe conclusion.

Onward and Upward!

Gemini Product Security Team


Collaboration Defeats Third-Party Risk 

We are delighted to announce that we have completed both __SOC 1 Type 2__ and __SOC 2 Type 2__ examinations, covering our exchange and Gemini Custody™ products. The exams were conducted by Deloitte & Touche LLP and make us the __world’s first cryptocurrency custodian *and* exchange__ to demonstrate this standard of financial operations and security compliance.

At Gemini, we aim to foster trust by demonstrating through action that as a company we follow through on the commitments we’ve made to upholding the highest levels of security and compliance for the benefit of our customers. We have done so by showing definitively through these independent third-party SOC evaluations that our operations and security compliance structures meet robust industry standards. We believe that these standards should be upheld by any cryptocurrency exchange and custodian.

In January 2019, we became the first crypto exchange and custodian in the world to complete a [SOC 2 Type 1](https://gemini.com/blog/gemini-completes-soc-2-review-a-worlds-first-for-a-cryptocurrency-exchange-and-custodian) examination, and followed that up with a [SOC 2 Type 2](https://www.gemini.com/blog/gemini-completes-soc-2-type-2-examination-another-first-in-crypto) examination in January 2020. Building on these milestones, we completed a [SOC 1 Type 1](https://www.gemini.com/blog/gemini-custody-and-exchange-completes-soc-1-type-1-examination) examination in April 2020 and recently completed our __SOC 1 Type 2__ examination in December 2020. 

The SOC 1 evaluates the design and implementation of our financial operations and reporting controls, while the SOC 2 evaluates the design and implementation of our security, availability, and confidentiality controls. The Type 1 examinations assessed those processes at a point in time while our Type 2 examinations test that our system controls across our exchange and custody product have been operating over the period covering 2020.

Gemini will continue to uphold the highest standards of security and operational compliance by undergoing __SOC 1 Type 2__ and __SOC 2 Type 2__ examinations on a yearly basis moving forward. 

Onward and Upward,

Yusuf Hussain  
Head of Risk

Gemini Completes SOC 1 Type 2 and SOC 2 Type 2 Examinations — Leading Crypto Industry

The Gemini Security team has seen an increase in crypto scams, as digital currencies have gained in popularity over the last year. These scams occur when hackers compromise a social media account and post deceptive content in order to solicit cryptocurrency from the account’s followers. The deceptive content posted by these hackers usually references prominent cryptocurrency exchanges, celebrities, or business leaders in order to exploit the victim’s trust.

Earlier this month, hackers associated with these scams escalated their activity when they compromised two YouTube channels that maintain over eight million subscribers. In this particular case, the hackers modified these channels to impersonate our brand, using the Gemini name and logo. In light of these ongoing events, we want to share how these attacks work, discuss Gemini’s ongoing actions to protect our customers, and provide some tips for YouTube channel owners to better secure their accounts.

__What Happened With the Hacked Accounts Impersonating Gemini?__  

The hacked YouTube accounts involved in this month’s events belonged to popular gamers [Natalan](https://www.youtube.com/natalan) and [El Fedelobo](https://www.youtube.com/user/elfedelobo), both of whom lost access to their YouTube channels. The hackers then used the compromised accounts to impersonate Gemini and perpetuate a cryptocurrency giveaway scam. Thankfully, after numerous reports flagging the videos and channels as scams, YouTube was able to step in and restore channel access to the rightful owners.

__How Crypto Giveaway Scams Work__

Giveaway scams are the most prevalent type of crypto scam and are typically posted to Facebook, Twitter, Medium, and YouTube. 

Most of these scams have similar components:

1. A hacker compromises and/or impersonates a social media account of a prominent public figure or crypto exchange. 
2. The account begins soliciting bitcoin or ethereum with a “send one, get two back” scheme. For any unsuspecting victims who send through crypto to the wallets highlighted on the fake accounts, that crypto will be lost forever. To be clear, __neither Gemini, nor any reputable cryptocurrency exchange, will ask you to transfer cryptocurrency payments through social media accounts__. To deposit cryptocurrency with Gemini, always make sure you receive the wallet address directly from [Gemini.com](https://www.gemini.com/).
3. Scammers often go one step further by incorporating a sense of urgency. This could manifest itself as a “Live Video” on YouTube or a statement noting that only a limited number of coins will be "given" away. The goal here is to encourage victims to act quickly and without scrutiny.

Once a victim sends funds to a "giveaway" address, they are gone forever. Due to the finality of cryptocurrency transactions, there is no way to reverse a transaction unless the recipient decides to return the funds. This makes these types of “giveaway” scams highly effective for malicious actors.

__What We’re Doing to Protect Gemini Users__

Gemini’s Security Team takes scams seriously and we use custom developed tools and third party services to proactively search the web and social media for scams, including those impersonating our brand. We are constantly analyzing trends in the space, updating our procedures, and building upon our scam detection systems.

Once alerted to a scam, Gemini protects our customers by blocking transactions to bad wallet addresses. Within the past three months alone, Gemini has prevented dozens of transactions destined for scam wallet addresses, saving our customers more than $200k.

__How to Protect Yourself From Crypto Scams__

The best protection is to educate yourself — anyone seeking to invest in cryptocurrency should be acutely aware of scams impacting the industry. Gemini covered a number of scams affecting the crypto ecosystem in a [previous blog post](https://www.gemini.com/blog/common-online-scams-and-how-to-avoid-them). An easy rule of thumb is that __if you don’t recognize a website or social media account, do not interact with it__. Gemini will never ask you to send cryptocurrency through social media, and other reputable exchanges shouldn’t do so either. 

__How to Protect Yourself as a YouTube Channel Owner__

The events earlier this month not only affected the targets of the crypto scam, but also the YouTube channel owners. It can be confusing and frustrating to wake up one day to see your channel changed without your permission. If you find yourself in this predicament, [follow these steps](https://support.google.com/youtube/answer/76187) laid out by Google to recover your account. Additionally, to protect yourself from this ever happening in the first place, it's important to [secure your Youtube account](https://support.google.com/youtube/answer/9701986). We would like to highlight using security keys for two-step verification as an especially strong defense against account takeovers. In fact, this is what we at Gemini [recommend to our customers](https://www.gemini.com/blog/gemini-becomes-first-crypto-exchange-to-support-hardware-security-keys-on) as well. 

Online scams are not new or limited to the cryptocurrency industry. But crypto users must be more aware of scams since all crypto transactions are final, unlike in traditional banking. Gemini’s Security and Fraud teams are continuously enhancing our ability to protect our customers from scams and other threats. If you’re passionate about building security solutions that solve unique challenges, consider applying to one of the [many roles](https://www.gemini.com/careers/security) we have open on the Security Team at Gemini. 

Onward and Upward,

Tory Cullen  
Associate Director, Threat Detection & Response

Our Take on YouTube Bitcoin Scams

This month we’ve highlighted the importance of [using two-factor authentication](https://gemini.com/blog/secure-your-accounts-with-more-than-just-a-password/) to ensure you remain safe online. 

But how do these safety measures actually work? 

In our final Cybersecurity Awareness Month post, our security team digs into the technical details behind one-time passwords, two-factor authentication, hardware security keys, and what the future holds for online security. 

Passwords have certain unavoidable shortcomings that, while acceptable years ago, are now exploitable by attackers on the web today. That’s why it’s important you use two-factor authentication, often called 2FA, to protect your accounts.

While all types of 2FA are more secure than using just a password, some do a better job of keeping your credentials safe. In this article, we’ll break down the three most common types of 2FA methods from least to most secure. 

__One-Time Passwords (OTPs)__

OTPs are by far the most common 2FA method due to their ease of use. The most common iteration of OTPs is a random password (only briefly valid) sent via SMS, email, or provided through a mobile application that you must use in addition to a password. 

The downfall of OTPs is that they are still passwords and therefore have the same weaknesses. If an attacker gains access to one of these codes, no matter how briefly, then your account could be at risk. Despite this risk, you should still use this method when available — in 2019, [Google said](https://security.googleblog.com/2019/05/new-research-how-effective-is-basic.html) that SMS-based 2FA helped block 96% of phishing attacks. 

__Push-Based 2FA__

Push-based two-factor authentication is less common but more secure than OTPs because there’s no password involved. In a push-based authentication flow, the website you’re logging in to sends a push notification to a phone with a request to authenticate. This method can be facilitated by Security as a Service (SaaS) providers like Duo or Okta, and is often used for enterprise authentication. 

The largest security concern for push-based 2FA is accepting an impostrous push, where an attacker has already stolen your password and initiates a push notification which you erroneously accept. 

__Hardware Security Tokens__ 

Earlier this month, we advised you to [use hardware security keys everywhere you can](https://gemini.com/blog/keep-yourself-and-your-cryptos-secure-with-one-simple-step/) to enhance your online security. 

The safest way to implement 2FA is with a Universal Two-Factor security token, or U2F. When employing this type of hardware security token, a website requests a U2F authentication. You are then prompted to connect the security token to your computer using USB, Bluetooth, or sometimes via Near Field Communication (NFC), and the token cryptographically signs the site’s request.

Most importantly, this method does not use passwords. 

Using a hardware key provides an extra level of security as you must physically interact with the token by either pressing it or tapping it against your laptop or mobile device. This means there’s little to no chance of incorrectly approving a request since the key is speaking directly to the website through your device.

__WebAuthn: Leaving Passwords Behind__

The shortcomings among OTPs, push-based 2FA, and hardware security tokens is that they all just serve as a cover for the main problem: passwords. 

[WebAuthn](https://gemini.com/blog/securing-your-gemini-account-with-webauthn) is a standalone authentication method that leaves passwords in the past: the end goal is to replace multi-factor authentication with a strong and cryptographic single factor authentication. Simply, WebAuthn is a browser application programming interface that allows you to register and prove ownership of your credentials for a given website.

Many devices capable of either verifying you biometrically or with a PIN are also capable of handling WebAuthn requests. Laptops that support Windows Hello, many Android phones, and most recently released iOS devices are all capable of using WebAuthn because the same hardware used for local authentication can be applied. 

Gemini gives everyone the ability to protect their accounts using the best security standards available. While you will still need a Gemini password for now, you can start using WebAuthn with either a [hardware security token](https://support.gemini.com/hc/articles/360044275792) or with Windows Hello and TouchID supported laptops.

In the meantime, we have partnered with hardware security key maker Yubico to promote staying safe online. Use the promo code YK20E-GEMINI20 for $20 off any two YubiKey Series 5 keys at checkout on the [Yubico website](https://www.yubico.com/store/?utm_source=Gemini-blog-oct15). The promotion ends November 30, 2020, 11:59pm Pacific.

As Cybersecurity Awareness Month comes to a close, we urge you to take this year’s theme to heart: Do Your Part. #BeCyberSmart!

Onward and Upward!

Team Gemini

Two-Factor Authentication: A Deep Dive

Last week we offered one piece of crucial advice from our security team: [use hardware security keys](https://gemini.com/blog/keep-yourself-and-your-cryptos-secure-with-one-simple-step) to protect yourself online everywhere you can. 

This week, as we continue to highlight Cybersecurity Awareness Month, we’re taking a step back to review why it’s more important than ever to ensure your online accounts have two-factor authentication enabled, and how setting up this second level of security on your online accounts can help keep you safe in a digital world.

__More User Accounts Lead to More Risk__ 

As the global workforce increasingly relies on the Internet, particularly during the COVID-19 crisis, we’ve seen people open more accounts online. More accounts means more potential for your username and password to become compromised. 

The average user has more than 100 accounts linked to a single email address, all of which should have a unique password. Without a password manager many people are likely to reuse passwords across various accounts or use weak passwords that are easy to remember. 

Attackers nowadays tend to be computer programs that are quick and effective at both figuring out weak passwords and helping convince unsuspecting users into handing over their credentials, typically through fraudulent emails. Known as phishing attacks, these fraudulent emails are among the most common threat vectors on the web. 

Verizon’s RISK team noted in their [annual Data Breach investigations report](https://enterprise.verizon.com/resources/reports/dbir/) that, since at least 2017, more than 80% of data breaches have leveraged stolen or weak credentials. This data point may make it sound like users are primarily responsible for these breaches, but credentials can also be stolen from vulnerable websites without you even knowing about it. 

__Second Factors for Increased Account Security__

Our current system of using passwords is inherently flawed. Your password is a secret that only you’re supposed to know, but the minute it is compromised, there’s little recourse until you’re notified of the breach. One way to protect your accounts is to use some form of second factor, which serves as a second layer of protection to ensure the security of your accounts. 

If passwords are something you know, then a second factor (2FA) is something that you have. The actual thing-that-you-have for a second-factor can vary: 

  1. it could be a cell phone, capable of receiving one-time passcodes after you’ve typed in a password
  2. it could be a security token, that either displays a one-time code or plugs directly into your computer, authenticating you to a website when you touch it 
  3. it may also not even be a thing, like an email account through which you can receive codes or direct links to access a website 

These 2FAs provide an additional layer of authentication, requiring you to have access to a device or application and use it to provide an extra credential that you wouldn’t know on your own.

Not all 2FAs are created equal, however. Tune in next week where we take a deep dive into the different types of 2FAs and how they stack up against each other. 

In the meantime, we have partnered with hardware security key maker Yubico to promote staying safe online. Use the promo code YK20E-GEMINI20 for $20 off any two YubiKey Series 5 keys at checkout on the [Yubico website](https://www.yubico.com/store/?utm_source=Gemini-blog-oct15). The promotion ends November 30, 2020, 11:59pm Pacific. You can learn more about hardware security keys [here](https://support.gemini.com/hc/articles/360044275792-How-Do-I-Use-My-Security-Key-). 

As we continue to focus on the security of Gemini customers, we wish you all a safe and secure Cybersecurity Awareness Month!

Onward and Upward!

Team Gemini

Secure Your Accounts With More Than Just a Password

One of the themes this Cybersecurity Awareness Month is “if you connect it, protect it” — we couldn’t agree more. Gemini’s security team wanted to take this opportunity to share one of the most impactful steps we think you can take to protect yourself and your crypto: use a hardware security key.

__More Than a Token Gesture__

To start, we suggest you use hardware security keys like [YubiKey](https://www.yubico.com/products/?utm_source=Gemini-blog-oct15) or [Google’s Titan Key](https://cloud.google.com/titan-security-key) for all your important online accounts, including Gemini. 

A hardware security key keeps your account safe even if your password is compromised. They provide the strongest level of protection when authenticating to your Gemini account by delivering hardware-backed, cryptographic proof of your identity, ensuring that only you, the holder of the physical hardware key, can gain access to your account, even if an attacker has compromised your password or successfully executed a SIM-swap attack on your mobile device.

Gemini employs [WebAuthn](https://webauthn.guide), which is considered the gold standard of hardware security key authentication for web applications, to ensure user accounts are kept secure. Logging in is faster and simpler with a two-step process: 

- Enter your username and password
- Tap the hardware security key with your finger or hold it to the back of your smartphone

__How Do I Set Up a Hardware Security Key on Gemini?__

You can register your hardware security keys to your Gemini account and review some frequently asked questions [here](https://support.gemini.com/hc/articles/360044275792-How-Do-I-Use-My-Security-Key-). Or, watch How to Add a Hardware Security Key to Your Gemini Account.

<iframe width="560" height="315" src="https://www.youtube.com/embed/NB2-CE6wgeE" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

The Gemini mobile app ([Android app](https://play.google.com/store/apps/details?id=com.gemini.android.app&hl=en_US), [Apple app](https://apps.apple.com/us/app/gemini-buy-bitcoin-instantly/id1408914447)) is the [first crypto exchange mobile app](https://blog.gemini.com/blog/gemini-becomes-first-crypto-exchange-to-support-hardware-security-keys-on) that can be used with dedicated hardware security keys. Just hold your YubiKey 5 NFC, YubiKey 5C NFC or Google Titan Key to the back of your phone and enter your password to login via mobile in the safest and most secure manner possible.

__Two Hardware Security Keys Are Better Than One__

If all this is music to your ears then you may want to jump in with both feet and enable your account to only use security keys to log in. To do this, register two hardware security keys so you can use one as a backup in case your primary security key is lost, stolen, or damaged. Once you’ve added a second security key you can disable other non-hardware-based security features on your account. 

To set up a second hardware security key head to your Gemini account settings and click the security tab. If you already have a security key registered to your account you’ll have the option to add a second key.

For Cybersecurity Awareness Month we partnered with Yubico to help users take their account security to the next level. Use the promo code YK20E-GEMINI20 for $20 off any two YubiKey Series 5 keys at checkout on the [Yubico website](https://www.yubico.com/store/?utm_source=Gemini-blog-oct15). The promotion ends November 30, 2020, 11:59pm Pacific.

__Get a Hardware Security Key and Use It Everywhere__

We’ve just got one piece of advice this Cybersecurity Awareness Month and it’s simple: get a hardware security key and use it everywhere you can. [This page has a list](https://twofactorauth.org/) of the types of authentication that popular web applications support, so take a look to find out where you can use your hardware security keys and stay safe out there.

Onward and upward!

Team Gemini


Keep Yourself and Your Cryptos Secure With One Simple Step

Today, Gemini is excited to become the first crypto exchange to introduce support for hardware security keys across both Android and iOS mobile devices via WebAuthn. Gemini customers can now use USB and near-field communication (NFC) security keys to securely sign into the Gemini Mobile App. 

Hardware security keys provide __the strongest level of protection when authenticating to your Gemini account__ by delivering hardware-backed, cryptographic proof of your identity. They ensure that only the holder of the physical hardware key can gain access to an associated account, even if an attacker has compromised your password or successfully executed a SIM-swap attack on your mobile device. This mitigates the risk posed by phishing, person-in-the-middle, and replay attacks that rely on stolen passwords or one-time password (OTP) codes.

To help our customers take advantage of this new offering, we have partnered with [Yubico](https://www.yubico.com) — maker of the popular hardware security key, YubiKey. Along with existing platform authenticators (e.g. TouchID and Windows Hello), YubiKeys provide a secure, cross-platform solution you can use to access your Gemini account via our Mobile App, as well as any other sites that support WebAuthn. You can learn more about our partnership with Yubico on the [Works With YubiKey](https://www.yubico.com/works-with-yubikey/catalog/gemini/) web page. 

In order to exclusively rely on hardware security keys and disable Authy/SMS based  authentication, you will need to register at least two hardware keys, including one supported by your mobile device. This could include a platform security key such as MacOS [TouchID](https://support.apple.com/en-us/HT207054) or [Windows Hello](https://support.microsoft.com/en-us/help/4028017/windows-learn-about-windows-hello-and-set-it-up) and a cross-platform hardware security key such as a YubiKey. To learn more about selecting and using the right security keys to access your account, refer to Gemini’s [support documentation](https://support.gemini.com/hc/articles/360044275792) and [instructional video](https://www.youtube.com/watch?v=NB2-CE6wgeE). 

Our security and engineering teams continue to prioritize new security features in order to provide the best and most secure user experience possible. We look forward to sharing more exciting security-focused announcements in the coming months. Come [join us](https://gemini.com/careers) if you’re passionate about cryptocurrency and blockchain-related security challenges. 

Onward and Upward,

Dave Damato, Chief Security Officer


Gemini Becomes First Crypto Exchange to Support Hardware Security Keys on Mobile App

We are pleased to announce that we have completed a SOC 1 Type 1 examination, which covers the financial operations and customer reporting controls of our exchange and Gemini Custody™. This exam was conducted by Deloitte & Touche LLP and makes Gemini the __world’s first cryptocurrency custodian and exchange to demonstrate this high standard of financial operations compliance.__
  
A SOC 1 Type 1 examination provides independent validation of a company’s financial operations and its customer reporting controls designed to mitigate the risk of significant error, omission, or data loss. By completing a SOC 1 Type 1 examination, our customers can confidently conduct, and subsequently attest to, their business on the Gemini platform.

SOC 1 is an internationally recognized achievement in the traditional financial services industry and we are proud to bring this standard of excellence to the cryptocurrency space. While vital to both our exchange and custody platform, the SOC 1 Type 1 is particularly important to our exchange operations, which execute a significant volume of complex financial transactions for our customers. The SOC 1 Type 1 validates the design and implementation of those operations and the integrity of their corresponding reports.
 
Going forward, we will be completing a SOC 1 Type 2 examination on an annual basis. This will independently verify whether our financial operations and reporting controls are not only designed and implemented appropriately __at a point in time__, but also that they have been operating effectively __over a period of time__.

Security is one of our core values at Gemini, as previously demonstrated by our [SOC 2 Type 1](https://gemini.com/blog/gemini-completes-soc-2-review-a-worlds-first-for-a-cryptocurrency-exchange-and-custodian) and [SOC 2 Type 2](https://gemini.com/blog/gemini-completes-soc-2-type-2-examination-another-first-in-crypto) examinations. __Trust is our product__; and we look forward to earning and maintaining your trust. Our SOC 1 Type 1 is yet another proof point that Gemini continues to strive towards achieving the highest standards of financial operations compliance for the benefit of you, our customer.

Onward and Upward,

Yusuf Hussain, Head of Risk


Gemini Custody and Exchange is world's first cryptocurrency custodian and exchange to attain this standard of financial operations compliance.

Gemini Custody and Exchange is First to Complete the SOC 1 Type 1 Examination

Gemini Custody and Exchange Completes SOC 1 Type 1 Examination — Another First in Crypto!

Gemini’s security team proactively monitors for illegitimate websites that pose a risk to our customers. If you know what to look for these sites are often easy to identify. Based on our experience we wanted to share some security best practices that can help you quickly spot risky websites and associated scams.


# The Basics of Identifying Fraudulent or Malicious Websites
Many fraudulent or malicious websites rely on impersonating a trusted website. This is typically done through the manipulation of URLs and hyperlinks. 

__Go Direct.__
The easiest way to avoid an untrustworthy website is to avoid clicking on a link and instead go to a trusted website through a search engine or by typing the URL directly into the browser. 

__Check the Address.__
Sometimes it’s not easy to browse directly to a website and we need to click a hyperlink. To reveal the URL that a hyperlink references, on your desktop computer, simply move your mouse over the link (don’t click it).  For Chrome and Firefox, the full URL for the link will appear in the bottom left of the browser. 

__Uncover Shortened and Unknown URLs.__
Any URL can redirect you to another location. When you see a shortened URL that you may suspect is malicious or a URL that is unknown, you’ll need to use a site like [URLscan.io](https://urlscan.io) to help reveal the true URL.¹

![google.com](//images.ctfassets.net/jg6lo9a2ukvr/gvvroMxZWhEzIjN05lftl/ea99a6fad492d24a4d9d700b22a91765/google.com.png)

Once you have the true URL, you’ll need to determine if it’s a legitimate site. In most cases it should be apparent. 

__Examine URLs Closely.__
There are some techniques that can be used to trick users into thinking a URL is trustworthy, when in fact it is not. Internationalized Domain Name (IDN) homography attacks use look-alike characters to trick users into believing they are accessing the correct URL. Examples include replacing the letter “O” with a zero or the letter “I” with the number one. Chrome and Safari resolve these deceptions when you move your mouse over a link, making them easy to spot. Firefox by default does not — although it is [configurable](https://developer.mozilla.org/en-US/docs/Mozilla/Internationalized_domain_names_support_in_Mozilla). 


# Advanced Tactics for Identifying Fraudulent or Malicious Websites
If, after all these steps, you’re still not sure a site is trustworthy, you should probably avoid it. However, if that’s not an option and you’re determined to proceed, there are more steps you can take to determine a website’s trustworthiness. 

__Assess Observed Malicious Activity.__
Using a scoring system, sites like [[URLscan.io]](https://urlscan.io/) take into account different data sources and page characteristics to determine the likelihood a site is malicious. Below is an example from URLscan.io of a warning displayed for a known phishing site. 

![url.io](//images.ctfassets.net/jg6lo9a2ukvr/2Ibfs8ktmWyniKvDaCZmE3/54536e9d588f86a0f1356a02ff4ca390/url.io.png)

__Validate Certificate Information.__
Today, most websites utilize Transport Layer Security (TLS) and underlying certificates. These certificates contain valuable information that can be used to gain a better understanding about a website. 

There are three types of certificates: 
- __Domain Validated (DV):__ cheap and easily obtainable
- __Organization Validated (OV):__ require a registrar to verify a company’s identity, providing an additional level of assurance
- __Extended Validation (EV):__ most difficult and expensive to obtain, providing the highest level of assurance 

A DV certificate contains no identifying information in the organization name field; instead it will typically just repeat the domain name. An OV certificate will include the name of the organization and an EV certificate will contain the name of the organization and the physical address. To check if a site uses an EV certificate, you can use SSL Labs.

![certificate](//images.ctfassets.net/jg6lo9a2ukvr/3V3BZE88rG03chNmo4IAQy/30d8fec526d4b2adabc4ac4ed2c01705/certificate.png)

Certificates are strong indicators, but not a guarantee, of a site’s relative trustworthiness.

__Check the Domain Registration Date.__
Malicious actors tend to create a domain just before use. As a result, if a domain is fairly new, it has a substantially higher chance of being malicious. Legitimate sites don’t often register a domain and then launch an e-commerce site in weeks. Although there will always be exceptions, domain registration date is another piece of information that can be used to determine potential scams or malicious sites. 

__Preview the Website.__
Although visiting an untrustworthy site can be risky, viewing a picture of the site won’t cause harm to your computer or result in the loss of personal information. Services like URLscan.io remotely view and capture an image of the site you’ve requested allowing you to take a peek at the site without taking the risk of actually visiting the site itself. With an image, you can assess the site for pixelated images, poor grammar, sloppy design, or other telltale signs of an untrustworthy site. If it looks unprofessional it’s likely not legitimate. 

# Preparing for Failure
Eventually everyone clicks on a link or visits a website that contains malicious content. The good news is that when properly used, most modern web browsers and accompanying extensions can act as a security boundary. 

__Update Your Browser.__
Modern browsers are very secure if they’re up-to-date and conveniently most now auto-update by default. But, in order to complete an update, you need to restart your browser periodically.  Keeping your browser up-to-date, avoids most problems. 

__Block Malicious Content.__
Malicious content in websites can be hosted in ad networks and/or be present in active website content. There are a number of third-party extensions for major browsers that block or reduce the amount of ads and active content rendered when visiting a website. uBlock origin is a popular ad-blocking extension that is easy to operate and has minimal impact on normal browsing. Although more difficult to use, NoScript is an example of a popular and highly effective extension that blocks active content. 

__Use a Password Manager.__
In addition to all of their traditional benefits, password managers also only fill out account details on saved sites. So, if you visit a phishing site that is attempting to steal your credentials, the password manager won’t automatically populate your credentials and in some cases may even provide a warning. 

# Arming You With Knowledge to Protect Yourself
Fraudulent and malicious websites cost consumers hundreds of millions of dollars every year. Hopefully these security best practices will help you to identify and avoid malicious websites.
Read our [Common Online Scams and How to Avoid Them](https://gemini.com/blog/common-online-scams-and-how-to-avoid-them) post to further help you protect yourself and always remember to use caution and good judgement online. Stay safe out there.


Onward and Upward,

Dave Damato, Chief Security Officer 




-----------------
¹ Limit URLs submitted to third parties to those you suspect are malicious. Legitimate URLs that reference sensitive information could be viewable by a third party. 


Detecting Fraudulent or Malicious Websites

The safety and security of customers has been paramount to Gemini since our inception and as the popularity of cryptocurrencies grows, the amount of attempted fraudulent activity in the space grows in parallel. In this blog post, we highlight some common online scams and provide suggestions for how to avoid becoming a victim. *Note: these scams do not uniquely target cryptocurrency users  so whenever you go online, keep these best practices in mind.*

## Tech Support Scams
Tech support scams prey upon people’s fear that their computer is broken or has been compromised.

__The Fake Phone Call__

In this scam, a criminal will call or email a target and state that their computer has a serious problem such as a virus. The criminal will then ask for remote access to the victim’s computer in order to run a fake diagnostic test and from there can easily steal information. 

__The Fake Pop-Up__

In a pop-up attack a criminal will deploy a pop-up window on a victim’s screen stating there is a problem with the computer that needs to be urgently fixed and request payment to resolve the non-existent issue.

__The Fake Website__

Criminals may also create fake support websites for well-known companies listing a fake support number. When the victim calls, the criminal will pose as a support employee and request remote access, allowing them to easily loot the victim’s account. 

## Get Rich Quick Scams
Get rich quick scams present potential victims with fake investment opportunities that promise large returns in a very short period of time with minimal effort (these schemes often are classified as pyramid or ponzi schemes).  

__The Foreign Prince__

Criminals contact a victim, usually via email or a phone call, and request a small investment or loan for an exotic and seemingly reliable opportunity in exchange for a high rate of return in the near future. 

__The (Swamp)land Deal__

Criminals may also post fake advertisements online that promise a small initial investment will yield outsized returns and wait for victims to contact them.

__Bank of Nowhere__

In a more elaborate get-rich-quick scam, criminals create fake investment platforms that similarly promise victims significant returns in exchange for a nominal investment. These platforms look legitimate and often include fake testimonials from people with inflated bank accounts. Once the victim makes an initial investment on the platform, they will be able to see their portfolio but unable to withdraw their money. When the time comes to pay a return on the investment, the criminal will make excuses as to why the funds can’t be paid and often ask the victim to pay an additional fee to release them.

## Romance Scam
Criminals pose as an interested romantic partner in order to take advantage of those looking to find companionship. 

__Catfishing for Dollars__

A criminal will create a fake dating profile using stolen pictures, then establish a close relationship with a victim over a long period of time taking great pains to avoid in-person interactions. Once the criminal senses the victim is comfortable, they will request money, often giving a reason with great urgency to induce payment (ex. medical expenses, frozen bank account, etc.).

## SIM Swap Scam
Criminals will acquire a victim’s name and phone number through fraudulent means and use that information to hack into systems connected to the victim’s phone. 

__Identity Theft__

Hackers continue to build sophisticated methods to target online accounts. One of the more common attacks is called SIM swapping, when an unauthorized individual tricks a mobile carrier into switching an existing phone number to a different device. The unauthorized individual can then intercept texts and calls, including two-factor authentication (2FA) confirmations sent via SMS. 

## Spotting Online Scams

__Do Your Homework__

Before making an investment, take the time to conduct thorough and careful research focusing on reputation, qualifications and credentials. If the opportunity sounds too good to be true, it likely is. Best practice is to check all information with a trusted third party such as a legal or financial professional. 

__Know Who You’re Dealing With__

Legitimate tech companies will not contact you by phone, email, text message, or “pop-up” warning to tell you there is a problem with your computer. If you believe something may be wrong with your computer,  reach out to a legitimate  technical professional or physically take your computer into a store to receive in-person support. 

__Ask Questions__

If you’re concerned with the legitimacy of a person, company, or investment  opportunity ‒ ask questions.  Be skeptical anytime anyone asks you to hand over money immediately. The more rushed an investment opportunity may be, the more likely it may be a scam.  

__Only Share Your Private Information With Trusted Parties__

Sometimes we have to give our pin numbers, passwords and personal information to access systems and services that we use in our daily lives. Make sure to verify that you are indeed communicating with a legitimate representative of a company you know and trust before revealing private information.

__Don’t Download Anything From Questionable Websites__

Is the URL unusually long and complicated or have spelling errors? Does the website seem especially poorly designed, old or amateurish? If so, you may be on a fraudulent website. Pay close attention to where and how you browse the web and never download anything from a questionable website. 

*For Current and Future Gemini Customers:* The best way to avoid losing funds from your Gemini account during a SIM swap scam is to download [Authy](https://gemini24.zendesk.com/hc/en-us/articles/115005755446-How-do-I-download-Authy-) for two-factor authentication disabling the [multi-device](https://gemini24.zendesk.com/hc/en-us/articles/115000053543-Turning-off-Authy-Multi-Device-Support) option. This ensures your device is the only device that can access your Authy account. Please also see [best practices for securing your Gemini account](https://gemini.com/blog/best-practices-for-securing-your-gemini-account).

We hope that this guide to online scams will help you stay safe and secure as you navigate the tools, technologies and systems that power our everyday lives. 

Onward and Upward,

Noah B. Perlman  
Chief Operating Officer

*The preceding examples are not a comprehensive list of all possible risks. Suggestions for avoiding online scams do not guarantee your security. You should always exercise caution online and when transacting in digital assets. Transactions in digital assets may be irreversible, and, accordingly, losses due to fraudulent or accidental transactions may not be recoverable. The nature of digital assets may lead to an increased risk of fraud or cyber attack.  *


Common Online Scams and How to Avoid Them

Gemini has completed its independent __SOC 2 Type 2__ examination, which covers the security compliance of our exchange and Gemini Custody™. This makes Gemini the __*world’s first crypto exchange and custodian to demonstrate the highest  level of security compliance in the industry*__.

In January 2019, we became the first crypto exchange and custodian in the world to complete a [SOC 2 Type 1](https://gemini.com/blog/gemini-completes-soc-2-review-a-worlds-first-for-a-cryptocurrency-exchange-and-custodian). While a SOC 2 Type 1 evaluates the design and implementation of system controls __*at a point in time*__, a SOC 2 Type 2 evaluates whether these system controls have been operating effectively __*over a period of time*__. Upon the completion of our Type 1, we publicly committed to following through with a Type 2 examination and — working again with Deloitte & Touche LLP — we’re proud to have achieved this!

At Gemini, __trust is our product__. Trust is built over time and it’s a function of doing what you say you are doing. Taking this further, simply saying you are secure is not the same as demonstrating you are secure to an independent third party. We feel that everyone should require these standards for any cryptocurrency exchange and custodian they use.

Going forward, we will be completing a SOC 2 Type 2 on an annual basis. We believe this kind of assurance, in addition to other safeguards we have implemented, such as digital asset insurance for our [hot wallet](https://gemini.com/blog/digital-assets-insurance) and [Gemini Custody™](https://gemini.com/blog/gemini-launches-captive-insurance-company-now-has-the-most-custody) helps protect our customers data and cryptocurrency and further our mission to __*empower the individual through crypto*__.

Onward and Upward,

Yusuf Hussain, Head of Risk





Gemini Completes SOC 2 Type 2 Examination — Another First in Crypto!

_On our mission to_ **_build the future of money_**_, we want crypto users to be educated and make informed decisions. In this three-part series, we will cover the most important factors to consider when choosing how, why, and who to store your crypto with for optimal safety and security. Today we start with the basics, the_ **_three tiers of crypto custody_**_._

**Part One: The Basic Tiers of Crypto Custody**

Crypto Custody is a broad term that can be applied to a number of different solutions for cryptocurrency storage. People have many choices when it comes to storing their crypto, and the connectivity of those solutions poses unique concerns for customers. Solutions range from self-custody options like a hardware or software wallet, to third-party, offline storage.

Custodying cryptocurrency (such as bitcoin, litecoin, ether, and many others), as opposed to other assets like cash, securities, or objects, requires a new kind of infrastructure — one that differs from the traditional paper-and-safe approach in banking.

Custody needs also vary. For instance, some investors might need to infrequently access or move their cryptocurrency compared to others who trade more frequently. Some investors might prefer to self-custody, while some institutions might require a third-party solution. There are three tiers of crypto custody available.

1\. **Self-custody: Build your own solution**

There are many ways to self-secure cryptocurrencies. Approaches can range from using consumer hardware wallets, to creating complex setups for the duplication, storage, and backup of your printed-out private keys (private keys are akin to your “password” — they allow you to access your crypto funds).

Many people want complete control of their cryptocurrency, and self-custodying provides a good solution. However, consider the difficulty in managing passwords and the frequency with which you may have a password reset performed. When dealing with self-storage and private keys there are no resets, a lost key is gone forever. Self-custodying, like keeping cash in your physical wallet or locked in drawer, poses its own risks. There is no third-party involved to manage that risk (or your funds) if you were to lose access to your keys, experience a destructive event like a fire or power outage, or pass away unexpectedly.

Holders should consider their access to software updates, as well as their personal capacity to correctly backup, restore, and implement geographic redundancy. Individuals should also consider how family members or intended beneficiaries would recover funds in emergency situations.

2\. **Partial custody: “Wallet plus” solution**

An emerging option in the cryptocurrency custody market is a self-managed wallet that offers some level of third-party assistance and related institutional controls or protections. Such an option may align to the needs of certain retail or high-net-worth investors who want to control their holdings, but also desire some level of assurance and institutional protections shy of full third-party management.

“Wallet plus” solutions scale up from basic hardware wallets by applying protocols such as two-factor authentication (or other identity verifications) and/or basic multisignature protections, where the third-party possess a key for co-signing the customer’s transactions.

This amounts to a form of split or partial custody, in which the customer and the third party are generally required to cooperate as part of the signing process. However, the exact amount of control either party has to sign the transaction without the other party — such as in the event of an emergency — depends both on the legal arrangement between customer and provider and the specific key management model of the custody solution.

Customers should consider (and ask about) the potential for third-party access and/or movement of their funds without their key. They should also be mindful of how a “wallet plus” provider handles software upgrades and practical concerns such as backup, recovery, and identity verification.

3\. **Third-party custody: Managed solution**

Third-party custody solutions allow customer funds to be held and managed entirely by a solutions provider. The user entrusts their assets to the custody provider, who is then the only entity acting on the customer’s instructions (the customer is not involved as a direct signing authority). Service level agreements (SLAs) dictate the terms and timing conditions regarding the storage, access, and movement of customer funds by the third party.

Third-party solutions are best suited to investors and institutions, such as asset managers, hedge funds, and/or high-net-worth individuals. They are the only solutions capable of offering bank-level protection for crypto security and safety, as they provide the most robust level of third-party control. That said, third-party custody solutions in the market today vary drastically in terms of what they offer (as we’ll discuss in part two of this blog series).

Customers also have the option to use multiple third parties (full-custody or wallet-plus) if they want two or more providers involved to verify instructions and move funds.

We know that there are a lot of products out there that market security, or offer low fees. We believe a third-party custody solution provided by a Qualified Custodian is the best way for institutions to store cryptocurrency.

Keep a lookout for our next two posts in this series. In part two we will dive deeper into institutional-grade custody solutions. In part three we will focus on questions and considerations when choosing a crypto custodian.

For more information, download our [Guide to Crypto Custody](http://bit.ly/2kAnkIU). We will also be hosting a [webinar](https://gemini.com/custody/whitepaper/) on October 7, 2019 at 12:00pm ET to discuss the state of crypto custody. Please join us!

Onward and Upward,

Brian KimJohnson, Software Engineer, Wallet Lead

The Three Tiers of Securely Storing Your Crypto Assets

Attackers have well-defined tactics for targeting your online accounts. Following these simple steps will improve your security posture.

### #1: Disable SMS Account Recovery

If you don’t know if you have this enabled, there’s a good chance you do, and having it enabled is a bad idea. Attackers can get control of your phone number via _phone porting_, where they call your phone carrier, pretend to be you, and ask them to start sending all calls and SMS texts to a phone _they_ own.

If this happens, and you have SMS account recovery enabled anywhere, the attacker can click **“Forgot password?”,** receive the verification text to _their_ phone, and successfully log in to _your_ email account.

Gmail, for example, provides instructions on disabling SMS account recovery [here.](https://support.google.com/mail/answer/183723?co=GENIE.Platform%3DDesktop&hl=en&oco=0)

**Note:** There are **many services** that allow SMS account recovery. It is particularly important to remove this option from your email, though, because your email address is often how you can reset passwords for _all_ your sites and services.

### #2: Disable SMS Two-Factor Authentication

First, understand that _SMS two-factor authentication_ is different than _SMS account recovery_, which I just described earlier. If you have SMS two-factor authentication turned on, it means that when you log in with your password on a site, that site sends you a text with a one-time code that you need to enter _in addition to your password_ to log in. This is different than _SMS account recovery_, where you click `Forgot Password?` and receive a one-time code to the phone number associated with your account to reset that account’s password. No password is needed in the latter case.

You should disable SMS two-factor authentication for the same _phone porting_ risk I outlined in point #1.

When you remove SMS two-factor authentication, it’s important to add a more secure form of two-factor authentication before signing out. You can add an _authenticator application_ like Authy, Duo, or Google Authenticator. When you use an authenticator app, the secret one-time codes are generated on your _physical device_, rather than texted to your phone number. That means an attacker with control of your phone number still can’t generate the one-time codes needed to log in to your account.

Even better than adding an authenticator app is adding a _security key_, which I describe later.

### #3: Turn off “Multi-Device” Support on your Authenticator App

However, some of these apps enable _Multi-device support_, which means you can enroll another device to generate the _exact same codes_ as your current device. This allows you to have a backup device generate codes in case you lose or misplace your primary device.

Unfortunately, how you confirm that you want to add a second device is via _text message_ to the phone number associated with your existing device. Thus, if an attacker has control of your phone number, they can take their phone, enroll it as a backup device for the authenticator app on _your_ phone,  receive the confirmation text, and successfully finish enrolling their phone’s authenticator app as your phone’s backup.

You can, and should, disable Multi-device support on your authenticator apps. Authy, as an example, explains how to do this [in their support pages](https://support.authy.com/hc/en-us/articles/360016317013-Enable-or-Disable-Authy-Multi-Device).

**Note:** Disabling multi-device support means that if you lose that device, you will have no way of logging in to your accounts (assuming you don’t have backup codes, or another form of two-factor authentication like a security key enabled). However, it also means that if an attacker gets control of your phone number, they have no way of generating these one-time codes, or enrolling their device as a “backup” to your authenticator app.

### #4: Set a Voicemail PIN (or disable it!)

Voicemails are remotely accessible. That means an attacker does not need control of your phone number to listen to your voicemail messages — they just need an internet connection.

Worse yet, some services that allow SMS account recovery allow you to [receive that one-time code via _phone call_](https://www.youtube.com/watch?v=ZpZbTPYB3cU)_._ An automated voice recites the one-time code to you on the call, and if you don’t answer, that recording goes to your voicemail. Thus, even if an attacker doesn’t have control of your phone number, they can click `Forgot password?` on your account, and have the site send the one-time code for reseting your password via phone call to your phone number. If you don’t answer the call (some attackers may wait until you are asleep), and you don’t have a voicemail PIN, the attacker can remotely log in to your voicemail and listen to that one-time code.

To prevent this attack, set a voicemail PIN on your phone, or call your carrier and disable voicemail on your phone entirely.

### #5: Advanced: Use a Security Key!
Some people believe that using an authenticator app like Authy or Duo instead of SMS two-factor means they are no longer vulnerable to phishing. This is untrue.

The issue with one-time numerical codes is that anyone in the world can enter them. Even if those codes can only be generated on your physical device, if you get tricked into sharing that one-time code with a fake website or fake customer support rep, an attacker can quickly use it along with your password to log in to your account from anywhere in the world.

There’s a solution to this problem called security keys on sites that implement the [WebAuthN](https://gemini.com/blog/securing-your-gemini-account-with-webauthn) standard. A security key is a physical device that provides a cryptographic signature to confirm your identity to a site. Security keys can include:
• Yubikeys
• MacOS Touch ID
• Feitian keys
• Even more, outlined [here](https://gemini.com/blog/securing-your-gemini-account-with-webauthn).

![0 T0R5pahuH7YBOG3o](//images.ctfassets.net/jg6lo9a2ukvr/4wDHB2L9UNBsc0Ktu4M1UQ/5a85568c384b3976390d58d1850a8864/0_T0R5pahuH7YBOG3o.jpeg)

*Examples of security keys, provided by Yubico*

Security keys have nothing to do with your phone number. The attacker would need physical access to that security key to try and authenticate as you. There’s no single-use numerical codes involved, so there is nothing you can provide a fake site or a fake customer support rep to log in to your account mistakenly.
Here’s an example of logging in with MacOS Touch ID to Gemini. After entering your password, Gemini prompts you to use the Touch ID feature of your Mac to complete the log in.

![1 a08Vgf mZBr5Hpya6cyBYg](//images.ctfassets.net/jg6lo9a2ukvr/6hCLqhzpuvM0W2gpynFtqe/1f4e754d5a2ac10c61c96aa0ee2e07ee/1_a08Vgf_mZBr5Hpya6cyBYg.png)

*Gemini prompting for Touch ID on MacOS*

Gemini became [the world’s first crypto exchange and custodian to support the WebAuthn security protocol](https://gemini.com/blog/securing-your-gemini-account-with-webauthn), which allows the use of security keys for logging in. You can add security keys to your Gemini account like so:

1. Under __My Account__, select __Security Settings__.

![1 M5gwQIIh yM2theOhMG5zA](//images.ctfassets.net/jg6lo9a2ukvr/hacyaiEJ8JhC4MVfO7evx/8492c54864b954ba614dc90c57524910/1_M5gwQIIh_yM2theOhMG5zA.png)

2. Scroll down to __Add Security Key__.

![1 JbLL32X03lLrn5Xwmw82BA](//images.ctfassets.net/jg6lo9a2ukvr/7ghtmmtG8pdC1hawf0PDa4/e0f51af705b922a0b09f748cd0cbcd97/1_JbLL32X03lLrn5Xwmw82BA.png)

3. Enroll any of the security key options mentioned in the [article above](https://gemini.com/blog/securing-your-gemini-account-with-webauthn).
If you enroll at least two security keys, you can then select the __Yes, only use Security Keys__ option. This ensures that you can only sign in to your Gemini account with your password and one of your security keys!

![1 K4eiMYNQq4HmMmBsc UpgA](//images.ctfassets.net/jg6lo9a2ukvr/3ZN0NSG8imqc1fHDtKHAHJ/9b73fbbfb5e367f5b248698e37675f0c/1_K4eiMYNQq4HmMmBsc_UpgA.png)

These 5 steps will improve your security posture dramatically.

Onward and Upward,

Team Gemini

Your security is our priority at Gemini. We've compiled 5 steps steps to improve your security when you're online!

5 Simple Ways to Secure Your Online Accounts

5 Quick Wins for Securing Your Online Accounts

Today, we are excited to [announce](https://www.prnewswire.com/news-releases/david-damato-joins-gemini-as-chief-security-officer-300903224.html) and welcome David Damato as Gemini’s new Chief Security Officer (CSO). Dave joins us from Tanium, the world’s most valuable privately-held cybersecurity company.

At Tanium, Dave built and led a mature cybersecurity team that engineered unique security solutions to help protect government agencies, Fortune 500 companies, and banks around the world. Prior to Tanium, Dave was an early member of the leadership team at Mandiant, a premier cybersecurity firm that was later acquired by FireEye. Dave brings his 20+ years of security leadership to Gemini and will reinforce our company philosophy that **_trust is our product_**.

Gemini has been built and operated with a _security-first_  mentality from day one. **Security** is the bedrock of our culture and one of Gemini’s four pillars along with **Product, Licensing,** and **Compliance**. It’s why, for example, we were the first exchange and custodian in the world to complete a [SOC2 Type I examination](https://www.gemini.com/blog/gemini-completes-soc-2-review-a-worlds-first-for-a-cryptocurrency-exchange-and-custodian) and allow you to secure your account using [hardware security keys](https://www.gemini.com/blog/securing-your-gemini-account-with-webauthn) via WebAuthn. We are excited for Dave to continue our Security Team’s tradition of building and pioneering world-class security solutions to secure the **_future of money_.**

Welcome to the team, Dave!

If you’re interested in joining Dave and the rest of the Gemini team, we’re hiring in our New York, NY; Portland, OR; and Chicago, IL offices! Check out our [careers page](https://gemini.com/careers/) for more information.

Onward and Upward,

Tyler

Gemini Welcomes David Damato as Chief Security Officer

Protecting your crypto is a cornerstone of our mission to **_build the_** **_future of money_**. We have operated from day one with a _security-first_ mentality and have focused on providing our customers with layered security features to help them protect their Gemini accounts. Simply put, **_trust is our product_**.

Today, we’re excited to raise the bar even higher by introducing support for **hardware** **security keys** via [WebAuthn](https://www.w3.org/TR/webauthn/) (“Web Authentication”). You can now use USB security keys (e.g., Yubikeys, Feitian keys, Trezor and Ledger hardware wallets, etc.), MacOS TouchID, and even Windows Hello as your two-factor authentication (2FA) method when signing in to your Gemini account. **_Gemini is the world’s first crypto exchange and custodian to support the WebAuthn security protocol._**

Using hardware security keys via WebAuthn to secure your Gemini account provides hardware-backed, cryptographic proof that it is you (and not someone else) signing in to your Gemini account — this prevents someone else from signing into your Gemini account even if they have your password. Using hardware security keys via WebAuthn also ensures that you only submit your two-factor credentials to the actual Gemini website and not a malicious website pretending to be the Gemini website.

**Advanced Security Protection**

_Recently, we published a blog post outlining_ [_best practices_](https://www.gemini.com/blog/best-practices-for-securing-your-gemini-account) _for securing your Gemini account. We encourage you to read it if you have not already done so._

We’ve added many layers of security throughout the years to help you keep your digital assets safe. Since our launch in 2015, we have _always_ required 2FA for all account sign ins; this has never been an opt-in security feature. We use the [Authy app](https://authy.com/features/) for 2FA, which either generates a secure 7-digit code on your mobile device or sends a code via SMS (Note: [We encourage you use the Authy app for 2FA rather than SMS](https://www.gemini.com/blog/better-two-factor-authentication)). This code is required when signing in to your Gemini account and when performing high-risk actions, like withdrawing your crypto.

But even with 2FA enabled via Authy, an attacker can stand up a website that looks just like Gemini, and ask for your username, password, and 2FA codes. Once divulged, your credentials can be used to access your Gemini account and ultimately withdraw your crypto. To mitigate this risk, we require additional email verification when you sign in from a new device. We also added support for [Authy Push](https://www.gemini.com/blog/introducing-authy-push) last year, which means that customers who have the Authy app installed will automatically receive a push notification that contains transaction details and requires confirmation every time they make a crypto withdrawal attempt. Furthermore, Authy Push will surface inconsistencies in a withdrawal in the event your computer is infected with malware.

Two weeks ago, we released a self-service tool called [Withdrawal Address Whitelisting](https://www.gemini.com/blog/best-practices-for-securing-your-gemini-account). When enabled, your crypto may only be withdrawn from your Gemini account to specific crypto addresses (submitted and approved by you).

**Securing your Gemini Account with WebAuthn**

You can register hardware security keys by going to your account [security settings](https://exchange.gemini.com/settings/security) page (you must be logged in). If you have more than one hardware security key, you may register multiple keys for added redundancy. When you register multiple hardware security keys, we’ll give you the option to exclusively use your hardware security keys for signing in to your Gemini account, which will disable 2FA codes sent via Authy or SMS. Withdrawals will continue to require Authy Push notification (or an SMS code) to confirm.

Authy Push, Whitelisting, and today’s announcement of WebAuthn, give you the advanced tools you need to secure your Gemini account. We will continue to strive to be the most secure place for you to buy, sell, and store your crypto today and tomorrow.

Onward and Upward,

Team Gemini

Securing your Gemini Account with WebAuthn

**Best Practices for Securing Your Gemini Account**

Security has been a pillar of Gemini since our inception. Our [security-first](https://www.gemini.com/blog/cold-storage-keys-crypto-how-gemini-keeps-assets-safe) mentality is baked into all of our products, serving as a true differentiator in the cryptocurrency industry. Our industry-leading [SOC 2](https://www.gemini.com/blog/gemini-completes-soc-2-review-a-worlds-first-for-a-cryptocurrency-exchange-and-custodian) Type 1 security compliance demonstrates our commitment to security and building trust in cryptocurrency as an asset class — **_trust is our product_**.

Empowering Gemini customers is also important. We recently released a self-service tool — **Withdrawal Address Whitelisting** — to provide our customers with an additional layer of protection on their Gemini accounts. Whitelisting allows our customers to (i) ban all withdrawal activity, or (ii) restrict withdrawals from their Gemini account to specific, approved addresses.

As we continue to upgrade this whitelisting feature and other account-level security options, below are additional security recommendations — including details on whitelisting, passwords, and best practices for managing your Gemini account and digital assets more broadly.

**PASSWORDS & ACCOUNT ACCESS**

The strongest passwords are impossible to guess. You should always use strong passwords to secure your desktop and laptop devices _as well as_ your Gemini account. Instead of writing down strong passwords — which you should never do — we recommend using a password manager.

Utilize a password manager’s built-in features to create unique, complex, and bespoke passwords for each site you require credentials for. It is far easier for the human mind to remember one complex password (i.e., for the password manager itself) which will then allow you to copy-and-paste any stored passwords from the manager to any websites you use, including Gemini.

Always remember that Gemini will never contact you asking for your passwords, PIN numbers, or password-manager information. If you ever receive an email requesting such information, please forward it to us at [fraud@gemini.com](mailto:fraud@gemini.com).

If you use the Gemini mobile app, we recommend securing it with biometric authentication via TouchID or FaceID for every login. A PIN you can easily remember, and never write down, is recommended for backup.

**TWO-FACTOR AUTHENTICATION (2FA)**

During account setup, we require users to go through the two-factor authentication process. This verifies your possession of _two of the three recognized factors_ for authentication: (1) Something you have (like a mobile device or hardware token), (2) something you know (like a password or PIN), and (3) something you are (which is identified by your fingerprint, face, or government-issued ID).

Gemini’s method for 2FA authentication is Authy, a commercial application which you can download to your mobile device or desktop computer [here](https://authy.com/download/). SMS verification is available; however Authy is more secure. For the highest level of security, we also recommend [disabling](https://gemini24.zendesk.com/hc/en-us/articles/115005755446-How-do-I-download-Authy-) the multi-device option in your Authy app settings. This will protect you from other devices being added with the ability to authenticate your logins.

In the event you have a new phone or phone number, you may temporarily lose access to Authy 2FA. You can resolve any 2FA lockout using the instructions [here](https://gemini24.zendesk.com/hc/en-us/articles/115005755506-What-do-I-do-if-I-can-no-longer-access-my-account-with-2FA-).

**ACCOUNT MANAGEMENT**

As you continue your Gemini account setup, you’ll link bank accounts to use as U.S. dollar funding sources for trading. The accounts you connect should be secured by strong passwords, ideally stored in a password manager.

Always practice situational awareness with your Gemini account: Never give out personal identifying information through untrusted sources, never allow remote access into your computer, and remember that Gemini’s primary support channel is email — not phone. (Our support team only calls customers in special cases, after coordinating a time and date via email.) When accessing the Gemini website, only use the URLs [https://gemini.com](https://gemini.com) or [https://exchange.gemini.com/signin](https://exchange.gemini.com/signin).

Once you deposit funds and start trading, review the Transaction History in your account settings regularly. If you ever suspect suspicious activity, please report it to us immediately at [support@gemini.com](mailto:support@gemini.com) or [fraud@gemini.com](mailto:fraud@gemini.com).

**WITHDRAWAL BANS & WHITELISTING**

In order to withdraw from your account, you will need to complete our full onboarding process (including uploading a government ID). Once that’s complete, U.S. dollar funds can be withdrawn to any connected bank account and cryptocurrencies can be sent to any withdrawal address associated with the currency type (BTC, ETH, LTC, BCH, ZEC, or GUSD).

For added security, you can use withdrawal address whitelisting to (i) ban cryptocurrency withdrawals, or (ii) restrict them to specific, approved addresses only. This ensures that in the unlikely event of an account takeover, your cryptocurrencies on Gemini **cannot** be sent to an unknown address.

Once you enable whitelisting in your account settings, _you will not be able to withdraw_ until there are active addresses on your whitelist. You can leave your whitelist empty to maintain a ban on all withdrawals.

You can add addresses, delete addresses, or edit address labels any time through your account settings on the Gemini website (whitelist information is read-only on the Gemini mobile app). For individual accounts, every address is subject to a seven-day holding period before it is activated for withdrawals. Whitelisting offline (or “cold”) addresses only is recommended.

On accounts with multiple users, address requests can only be made by account administrators or managers. Requests are subject to a dual-control process, whereby a fellow administrator or manager must approve each request (eliminating the need for a seven-day holding period).

As an added security protection, you must contact [Gemini Customer Support](https://gemini24.zendesk.com/hc/en-us/requests/new) directly to disable whitelisting.

**TRUSTED PROTECTIONS**

All self-service measures regarding passwords, 2FA, account management, and whitelisting build on other protections inherent to Gemini’s security processes.

Temporary withdrawal holds are one example: Changing the [email address](https://gemini24.zendesk.com/hc/en-us/articles/115005755526-How-do-I-change-my-email-address-) on your account or resetting a forgotten password results in a 24-hour hold on cryptocurrency withdrawals. In addition, we allow users to freeze their accounts in the event of an unauthorized login or other suspicious activity. Once reported, incidents are investigated by our expert support and security teams.

Additionally, Gemini has instituted a means to identify when new devices are connecting to an account for the first time. This activity instantly prevents withdrawals until subsequently verified by the account owner.

Account freezing and withdrawal bans (via whitelisting) offer the highest level of security because they restrict customers’ cryptocurrency holdings to Gemini, which we view as ultimately the safest option for customers. Our security approach is further bolstered by platform and marketplace protections that include U.S. dollar capital reserves, [digital asset insurance](https://www.gemini.com/blog/digital-assets-insurance), [market surveillance](https://www.gemini.com/blog/introducing-marketplace-surveillance-technology) technology, and a SOC 2 Type 1 security review by [Deloitte](https://www.gemini.com/blog/gemini-completes-soc-2-review-a-worlds-first-for-a-cryptocurrency-exchange-and-custodian).

[Security](https://gemini.com/security/), Product, Licensing, and Compliance are the four pillars of Gemini, and our efforts are setting the standard for cybersecurity in the crypto industry. As we deliver further security features and enhancements over the course of 2019, we will continue to share best practices for investing safely and securely in the **_future of money_**.

Onward and Upward,

Team Gemini

Best Practices for Securing Your Gemini Account

Last month, we upgraded our wallet infrastructure that handles Bitcoin transactions, which delivered major improvements to our customers. This was the completion of a year-long effort to support new cryptocurrencies, improve customer experience, and adopt best practices for network usage. We wanted to share more about our overall wallet infrastructure project and the decisions made along the way.

Our team custom-built the first Gemini wallet — a safe, secure wallet and signing infrastructure — around market conditions in 2014. As the market evolved so did our needs: we needed software capable of supporting a fee market, multiple networks, and multiple cryptocurrencies.

We sought out new tools and partnered with [Chris Stewart](https://twitter.com/Chris_Stewart_5), the developer of bitcoin-s, to add support for each of our target cryptocurrencies. In 2018, we launched support for Zcash, Litecoin, and Bitcoin Cash using a more robust, modernized crypto wallet infrastructure.

After debuting these new cryptocurrencies on Gemini, we turned our focus to migrating Bitcoin.

As part of the upgrades this year, we introduced support for Segregated Witness (SegWit) addresses and transaction batching. As our customers may have noticed this means that SegWit addresses — which begin with _bc1_ — can now be used for Bitcoin deposits and withdrawals. Both of these improvements required end-to-end integration through our online and offline signing systems (along with many other efforts).

Our decisions about SegWit and batching were not made lightly. Building trust in cryptocurrencies as an asset class — and in Gemini as a platform — motivates every product choice we make. This is especially true of changes that affect our end customer’s experience, as these wallet updates do.

**Understanding SegWit**

The SegWit protocol update, which activated in late 2017, changed the way information is stored and processed on the Bitcoin blockchain.

SegWit allows digital signature information to be stored separately (or _segregated_) from its transaction data. Without signatures, Bitcoin transactions weigh around 30–40 percent less, thus taking up less “block space” on the network and reducing the transaction fee. As block space is limited, any decrease in transaction size allows for more transactions per block and greater overall throughput in the network.

Our choice to use native SegWit addresses was based on block space savings as well as safety concerns. Specifically, native SegWit addresses work _only_ on the Bitcoin blockchain — they do not work for other cryptocurrencies. On the other hand, however, cryptocurrencies other than bitcoin can be sent to a legacy (non-native SegWit) address, which can cause loss of funds. Some other Bitcoin exchanges and custodians have offered partial SegWit support (withdrawals and legacy P2SH-style addresses) since early 2018, but **_Gemini is the first major exchange to launch full support of SegWit_**, complete with native SegWit deposit addresses. We think it’s the right time to make this change, though there will still be some growing pains. Notably, while some block explorers are capable of tracking native SegWit addresses, the support varies widely from one solution to another.

These considerations, among many others, factored into Gemini’s decisions about when and how to launch SegWit support.

**Realizing the Benefits**

Our team views SegWit as a positive step forward for crypto and the broader **_future of money_**. As SegWit’s use, support, and adoption grows, it will help reduce fees, wait times, and network congestion. Critically, SegWit transactions lay the groundwork for more advanced technologies; of which the Lightning network is the most well known.

We believe SegWit will become the standard, and in doing so, will create extensive benefits for all participants on the Bitcoin network.

Given the level of community adoption — and ecosystem support — we now recommend that all Gemini customers move to using SegWit addresses. After extensive testing and development, we know that launching SegWit support is the right decision for our customers at the right time. Start using SegWit addresses (or [click here](https://exchange.gemini.com/deposit/btc) to make one) to support our mission and our commitment to building a better Bitcoin experience and the **_future of money_**.

Onwards and Upwards,

Brian KimJohnson, Software Engineer

Gemini Upgrades Wallet with Full Support of SegWit

Recent events in the cryptocurrency industry have elevated an important conversation about how cryptocurrencies are custodied by individuals or exchanges. People have many choices when it comes to storing their crypto assets, from self-custody options like a hardware or software wallet, to regulated and unregulated exchanges. There are varying opinions around which approach is best, but each comes with its own tradeoffs and level of risk that a consumer should understand and be comfortable taking on.

We believe that for most investors, storing their cryptocurrency on a regulated and secured crypto exchange and qualified custodian, such as Gemini, is the right approach for the many reasons we will discuss below.

Trust has been the foundation of Gemini’s business — our product — since we [launched](https://www.gemini.com/blog/and-were-live). As a regulated cryptocurrency exchange and qualified custodian, we’ve invested years of effort and millions of dollars in technical and control measures to help prevent undue losses and nefarious activity. As observers of our recent [ad campaign](https://www.marketwatch.com/story/winklevoss-twins-gemini-ad-campaign-hopes-to-ignite-the-peoples-movement-2019-01-09) know, we have a [strong point of view](https://www.gemini.com/blog/geminis-principles-for-the-crypto-revolution) about the importance of regulatory oversight, compliance, and security in the crypto space. We’ve backed up that point of view by demonstrating our protections by [completing](https://www.gemini.com/blog/gemini-completes-soc-2-review-a-worlds-first-for-a-cryptocurrency-exchange-and-custodian) a SOC 2 Type 1 review conducted by Deloitte & Touche LLP, a Big Four auditor.

As you embark on the crypto journey, it’s important to determine what approach is right for you. Do you prefer storing your dollars under your mattress instead of a bank? If so, then the “digital mattress” equivalent of a hardware or software wallet is right for you. If you prefer to keep your assets in a regulated financial institution, then a regulated financial institution is the best option to store your cryptocurrency. This will require you to identify which [organizations to trust](https://www.forbes.com/sites/dantedisparte/2019/01/29/gemini-the-winklevoss-twins-break-new-ground-on-digital-trust/#5062ebf826b6), and that starts by understanding the protections and protocols necessary to safely store, secure, or facilitate access to your holdings.

When assessing an organization’s custody services, there are several measures you should consider. For instance, what jurisdiction does the organization operate in? What type of licensing does the company have? Is there regulatory oversight? What is the background of the executive team? What are the company’s core values? Was the company built with a security-first mentality?

Gemini is a safe place to buy, sell, and store cryptocurrency — not because we say it is — but because of the measures we have put place to protect your crypto and the independent third parties that verify them. They are as follows:

[**Redundancy with keys**](https://gemini.com/security/) **(and the facilities and devices that store keys).**

*   All of our private keys, which are used to sign cryptocurrency transactions, are custodied offsite in the secure, guarded, geographically distributed facilities of our Cold Storage system. These keys exist on hardware security modules (HSMs) that meet or exceed [FIPS 140–2 Level 3](https://en.wikipedia.org/wiki/FIPS_140-2#Level_3) U.S. government computer security standards.
*   Multisignature technology (or “Multisig”) provides added security from attacks and increased fault tolerance. We have contingencies in place in the event of a catastrophe or if all of our facilities and equipment in an entire region were to become inaccessible or destroyed.

[**Digital asset insurance**](https://www.gemini.com/blog/digital-assets-insurance) **and capital reserves.**

*   A small portion of crypto are held in Gemini’s online “Hot Wallet” environment, with key management via dedicated FIPS 140–2 Level 2 HSMs provided through the AWS Cloud. We [maintain insurance](https://www.gemini.com/legal/user-agreement#section-digital-asset-insurance) (from a combination of underwriters) in an aggregate amount that is _greater than the value of our customer’s crypto assets held in our Hot Wallet_.
*   We also maintain capital reserves, which are required of us as a New York trust company and fiduciary under the New York Banking Law. All customer U.S. dollar fiat funds held in omnibus accounts are held at FDIC-insured banks in the United States, and these funds are segregated and legally distinct from our business and operating accounts. Capital reserve requirements help ensure that Gemini has sufficient capital to continue operations and support our customers.

**Extensive internal controls.**

*   Multiple signatories are required to transfer funds out of Cold Storage. Our CEO (Tyler Winklevoss) and President (Cameron Winklevoss) are unable to individually or jointly transfer customer funds into or out of our Hot Wallet or Cold Storage system.

Customers seeking additional protections have even more options. For large crypto holders, we offer [custody services](https://gemini.com/custody/) with segregated addresses. And for any  Gemini account, [whitelisting](https://gemini24.zendesk.com/hc/en-us/articles/360001411543-How-do-I-enable-withdrawal-address-whitelisting-) can be enabled to prevent assets from being sent to unknown addresses.

We designed all of these measures from our firm belief that using a regulated, trusted, qualified custodian is the best option for storing cryptocurrency holdings of any size. Because we serve both individuals and institutions, we can offer bank-level protections to hobbyist traders and professional users alike. As discussed above, using a hardware wallet, software wallet, or unregulated exchange is the digital equivalent of keeping cash under your mattress: It’s an option — and perhaps a useful one for small amounts (just like having $20 in your back pocket is) — but it gets riskier as your holdings grow.

Gemini’s team recognizes that cryptocurrencies emerged from a combination of technological innovation and distrust of traditional, centralized institutions. But regulated, licensed financial institutions still have an important place in the world of cryptocurrencies, alongside new decentralized alternatives.

True interoperability between the worlds of fiat currencies and cryptocurrency is crucial to keeping customers safe. **_As your bridge to the future of money_**, Gemini is advancing a future of crypto without chaos — one without catastrophic, unnecessary losses that harm consumers and stunt industry progress. We continually revisit the protections and protocols we use to store, secure, and facilitate access to your crypto holdings — and we hope all of our peers in the crypto space will do the same.

Onward and Upward,

Eric Winer, VP of Engineering

Cold Storage, Keys & Crypto: How Gemini Keeps Assets Safe

In 2018, Gemini engaged with Big Four auditor Deloitte & Touche LLP (Deloitte) to execute a SOC 2® — SOC for Service Organizations Type 1 examination. After months of preparation and an in-depth external review, we are pleased to announce that Gemini has successfully completed its SOC 2 Type 1 examination. This makes Gemini the **_world’s first cryptocurrency exchange and custodian to demonstrate this level of security compliance in protecting customer data and funds._**

Providing you with a safe and secure platform to buy, sell, and store your cryptocurrency is paramount to our mission to **_build the future of money_**. In the traditional financial and technology industries, SOC 2 reviews have become an industry standard for demonstrating security compliance. Our SOC 2 review — coupled with our [digital asset insurance](https://www.gemini.com/blog/digital-assets-insurance) — is another step we’ve taken towards raising the bar for consumer protection, safeguards, and industry best practices.

Gemini’s exchange and custody platform was built with a “security-first” mentality from the start. Continuing that approach, Deloitte performed an independent evaluation of the design and implementation of Gemini’s security controls. These controls have been independently inspected to meet the trust services criteria set by the American Institute of Certified Public Accountants (AICPA). This included a review of Gemini’s exchange application, infrastructure, and underlying customer database, as well as its institutional-grade cryptocurrency storage system that custodies the private keys of Gemini’s online and offline wallets.

We feel strongly that this standard of compliance is what all retail and institutional consumers should expect of their cryptocurrency exchange and custodian. We know what’s at stake when you trade and store crypto. That is why, in addition to our SOC 2 Type 1 review, we are also committed to obtaining our SOC 2 Type 2 review in 2019. This additional level of assurance will further validate the effectiveness of our internal controls.

Going forward, we will perform a SOC 2 examination on an annual basis in order to demonstrate our ongoing commitment to safeguarding your data and cryptocurrency.

For questions, please reach out to [support@gemini.com](mailto:support@gemini.com).

Onward and Upward,

Yusuf Hussain, Head of Risk

Gemini Completes SOC 2 Review — A World’s First For a Cryptocurrency Exchange and Custodian

Building a rules-based marketplace is critical to our mission to build the future of money — individuals and institutions need to feel safe and secure when trading. To that end, we are excited to announce that over the coming months we will be implementing Nasdaq’s [SMARTS Market Surveillance](http://business.nasdaq.com/market-tech/marketplaces/market-surveillance) technology to monitor our marketplace.

![](https://cdn-images-1.medium.com/max/800/0*t_XV97YHFXIFljsR.png)

SMARTS Market Surveillance, which is considered the most widely deployed surveillance system in the world, will enable us to monitor across all of our trading pairs, including BTC/USD, ETH/USD and ETH/BTC. Further, SMARTS will surveil our newly launched Gemini Block Trading™, as well as Gemini Auctions™, which are used to determine the settlement price for the Bitcoin (USD) Futures Contracts that trade on Cboe’s CFE Exchange under the ticker symbol “XBT” ([contract specifications](https://cfe.cboe.com/cfe-products/xbt-cboe-bitcoin-futures/contract-specifications) | [fact sheet](https://cfe.cboe.com/products/bitcoin-qrg.pdf)).

Adding trade surveillance technology is the most recent development in our efforts to build a rules-based marketplace, which already includes: (i) an Information Sharing Agreement with Cboe Exchange, Inc. allowing for cross-market surveillance, (ii) our internal Trading Policy with respect to material nonpublic information, and (iii) our Marketplace Conduct Rules that apply to all trading on our marketplace.

Our market surveillance team looks forward to using Nasdaq’s Alerts Development Environment and Alerts Management System to become a market leader in custom surveillance rule creation and alerting for the crypto-asset market. We believe that it is this advanced functionality combined with Nasdaq’s proven, rule-based approach to traditional financial market surveillance that will allow for the most thorough monitoring of the evolving crypto-asset marketplace, today and into the future.

Gemini looks forward to a long and productive relationship with Nasdaq.

Onward and Upward,

Team Gemini

Introducing Marketplace Surveillance Technology

From day one, Gemini has required 2FA using the Authy service for all accounts. Starting on March 13, 2018 we will be enabling a new Authy feature for added security while performing sensitive transactions: Authy push notifications.

#### Sessions vs transactions

Most consumer-grade authentication systems operate at the level of sessions. Users provide their credentials — which may involve multiple factors such as a password in conjunction with a short-lived, one-time passcode. This initial step creates an authenticated “session” lasting for a fixed duration (e.g., one hour). During this time, users are allowed to browse around the site and use various features. After the clock runs out, the session reverts to an unauthenticated state, requiring users to prove their identity once again.

One shortcoming of this model is that after initial authentication, any number of actions are allowed within the authenticated session. Transactional authentication improves on that model by tying the authentication to a unique action. “Unique” being the operative keyword here: asking users to type their password one more time or even enter another 2FA code is not sufficient. Without knowing what will happen after completing those steps, users are effectively approving _some_ action which may not be what they had in mind.

Phishing attacks and malware can exploit that disconnect. For example, in a phishing attack a user will be mistakenly interacting with a fraudulent copy of the service operated by an attacker. This fake website can:

*   Collect the password
*   Collect a 2FA code

At this point, the attacker can turn around and use those credentials (quickly, before the 2FA code expires) to login to the legitimate website to impersonate the legitimate customer.

Requiring additional 2FA codes to perform sensitive actions such as authorizing a payment is not sufficient to mitigate this. The phishing site can adjust its tactics, feigning an error after collecting the initial 2FA — even though it is valid and used by attacker to login — and trick the user into giving away a _second_ 2FA code to use for authorizing the subsequent action.

While other authentication systems such as U2F are not susceptible to phishing, they have similar limitations against malware. If the device a customer is using to access their favorite website has been compromised by malware, that malicious software can silently alter user actions. For example, it can change the Bitcoin address submitted to a web page in order to funnel payments to a different destination. Not even the proof-of-presence required in U2F by pressing a button helps. While that event cannot be fabricated by malware running on the device — the token itself registers the contact — the user is more than willing to press the button in service of the attacker. After all, they are under the impression that this action will result in some intended, legitimate behavior. In reality it is authorizing _some_ action that can be manipulated under the covers by malware. (Not to mention, malware can wait until authentication is complete to take advantage of the resulting session, complete with all required cookies and even TLS channel binding.)

#### Adding context

The root cause of these problems is lack of context about the action being approved: the user believes that providing a 2FA code or pressing a button will lead to one outcome while the adversary has carefully altered the setup to trigger something else entirely. What is required is an _out-of-band channel_to verify the intended transaction, independent of the original device where it is initiated.

This is far from a new idea; there are many precedents for such verification in high-value scenarios, typically involving special purpose hardware:

*   Some [cryptographic hardware tokens](https://www.ftsafe.com/products/PKI/LCD) feature a trusted display and user-interface with physical buttons to confirm transactions. That display is driven by the token and cannot be manipulated by the machine the token is attached to.
*   Several Bitcoin hardware wallets have a display for confirming the destination addresses on transactions. Even if local malware running on the PC sends a different Bitcoin transaction for signing — as [malware in the wild](https://www.kaspersky.com/blog/cryptoshuffler-bitcoin-stealer/19976/) was discovered to be doing by manipulating the clipboard — the user has an opportunity to detect this substitution because the display cannot be manipulated.
*   A more mainstream example can be found in NFC payments using a smart-phone. While standard credit card payments (even with chip cards) involve blindly trusting the point-of-sale terminal to charge the expected amount, mobile wallets can first [display the amount requested and obtain confirmation](https://www.youtube.com/watch?time_continue=136&v=S5e2EoP_irg&t=1m40s) from the consumer before proceeding with the payment.

#### Introducing Authy Push Notifications

Luckily esoteric hardware is not required to get the benefits of out-of-band authentication. With the right application installed, the ubiquitous smart-phone can function as the independent verification channel. Authy, used by Gemini, is an example of such an app. When customers attempt to withdraw cryptocurrency from their Gemini account, they will receive an approval request on their mobile Authy app containing transaction details:

![](https://cdn-images-1.medium.com/max/800/0*hYv_jA7k0Sc3C1Q5.png)

Unless the transaction is confirmed by clicking on the “Approve” button, no funds will be sent. Note this exchange is taking place on a completely different channel (via the Authy mobile app) than the browser session used to access Gemini. In fact, it is typically taking place on a different _device_altogether: a customer may login to the exchange on their laptop while receiving the notification on their phone. This out-of-band channel is protected from risks associated with the primary device. For example, even if a customer accidentally provides their password and 2FA code to a phishing site, that site has no way to compel that person to approve the notification requesting approval for funds transfer. More importantly, there is no way to obscure or misrepresent the intent of the transaction. Crucial details including amount and destination address will be included in the UI, giving the legitimate customer an opportunity to recognize it for what it is: an attempted theft. Similarly even malware running on the primary device can not in general cause the push notification prompt to be approved outside of user consent. (It would _also_ require compromise of the mobile device to forge that approval.)

#### Roll-out plans

At this time, for customers who are already using the Authy mobile app, Gemini will require push notification approval for all crypto-currency withdrawals — no action is required to opt-in to the additional level of security. Gemini [strongly recommends all customers to use the Authy mobile app](https://gemini.com/blog/better-two-factor-authentication/) and cautions against relying on SMS for two-factor authentication.

If you have any questions, please reach out to our support team at [support@gemini.com](mailto:support@gemini.com).

Onward and Upward,

Gemini Security Team

At Gemini, we take security seriously. 2FA is a requirement to ensure our customers are kept safe when performing sensitive transactions.

Authy Push Notifications for all Gemini accounts

Introducing Authy Push

We have required all of our customers to use two-factor authentication (2FA) from day one. In keeping with our security-first philosophy of protecting and educating our customers, we want to provide some background on our 2FA system **_to encourage our customers to use the Authy app for 2FA rather than SMS_**, and to dispel some common misconceptions.

#### About Authy

Gemini uses the [Authy service](https://www.authy.com/product/) for 2FA. Authy is an independent cloud service called on to perform secondary verification once we have checked that a customer has provided correct login credentials (i.e., email and password).

Authy offers multiple options for second-factor verification:

1.  **SMS**: One-time passcodes (OTPs) are delivered via text message.
2.  **Voice**: Similar to SMS, with the codes read aloud by an automated text-to-speech system.
3.  **Mobile application**: Users install an app (or Chrome extension), which generates an OTP based on a secret “seed” and current time according to the TOTP standard. TOTP is an [open standard](https://tools.ietf.org/html/rfc6238) implemented by multiple apps including [Google Authenticator](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en) [and the Authy app](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en).
4.  **OneTouch**: Pioneered by [Duo Push](https://duo.com/product/trusted-users/two-factor-authentication/authentication-methods/duo-push), this model dispenses with codes altogether. Instead users confirm a login by responding to a simple yes/no prompt.

Each of these options comes with different tradeoffs. **SMS** is simple and can work on any mobile phone including legacy flip-phones that are not “smart” and don’t have an application ecosystem. **Voice** codes further improve accessibility by allowing codes to be sent to landlines or heard by users who have difficulty with visual information.

**TOTP** codes generated using an app do not require internet connectivity. TOTP apps can work offline, even if the phone itself has no service (e.g., when a user is outside a service area). **OneTouch** further improves usability by avoiding the need to transcribe digits from one device to another, but (unlike TOTP) it does require a data connection.

#### Encouraging Mobile Apps

Gemini has always supported SMS and mobile app options for 2FA. However, in recent interactions with customers, the Gemini support team reached the conclusion that many customers were either not aware of the Authy mobile app, incorrectly viewed SMS as equivalently secure to the Authy app, or were interested in other alternative TOTP apps. We are now actively encouraging all of our customers to install the Authy app. We believe that **_switching to the Authy app will improve security without any downside to usability_** for nearly all customers, as discussed below.

At the same time, we recognize there is no one-size-fits-all solution. Customers may have unique requirements which rule out the Authy mobile app, so we will continue to support SMS. However, once you have Authy installed, you will no longer be able to request codes via SMS. We’re doing this to prevent would-be attackers from circumventing the security of the Authy app by falling back to SMS.

#### Risks Associated with SMS

A 2003 [ruling](https://www.fcc.gov/general/wireless-local-number-portability-wlnp) by the Federal Trade Commission (FTC) called for number portability between wireless carriers, which allows consumers to keep their existing phone number when they switch from one wireless carrier to another wireless carrier. Number portability increased competition between wireless carriers by removing one of the major obstacles that prevents consumers from switching to a better plan: the hassle of losing their existing phone number. The FTC ruling made it much easier for consumers to keep their number while switching carriers — too easy, perhaps. Call it the law of unintended consequences: the drive to portability also inadvertently opened the door to [number-porting attacks](https://www.ftc.gov/news-events/blogs/techftc/2016/06/your-mobile-phone-account-could-be-hijacked-identity-thief).

Last July, the National Institute of Standards and Technology (NIST) came out with a [recommendation](https://pages.nist.gov/800-63-3/sp800-63b.html) to deprecate the use of SMS for 2FA. Almost on cue, the industry experienced an uptick in the incidence of phone number hijacking events. In this type of fraud, a miscreant impersonates the legitimate customer and ports his or her number to a _different_ carrier, pretending to be that person switching carriers. If the attacker is successful in convincing the other carrier to reassign the number to an attacker-controlled device, all voice calls and SMS messages will be routed to the perpetrator. As a result, _any_ 2FA system relying on SMS or voice for delivering one-time passcodes is susceptible to such attacks.

#### Setting up the Authy Mobile App

Setting up the Authy mobile app eliminates the risks associated with using SMS for 2FA, however, to fully mitigate SMS vulnerabilities **_you need to make sure you_** [**_turn off_**](https://gemini24.zendesk.com/hc/en-us/articles/115000053543-Turning-off-Authy-Multi-Device-Support) **_“multi-device” in the Authy app._** This prevents the same number-porting attack (mentioned above) from being used to obtain access to your SMS messages to perform an unauthorized install of your Authy account. When it is turned off, no additional instances of the Authy app can be provisioned. We recommend all Gemini customers to keep multi-device disabled, only enabling it **_temporarily_** when setting up a new device (for example, when upgrading your phone). If you’re resetting or trading in your phone, we also recommend that you install the [Authy desktop app](https://www.authy.com/app/desktop/) first, so that you can use it to authorize your new phone. We are also working with the Authy team to make the process of switching or upgrading devices easier and more secure for all Gemini customers, regardless of your multi-device settings.

#### Looking Forward

While using a mobile app to generate codes is an improvement, there are other attack vectors that no 2FA solution based on one-time passcodes (OTPs) can solve. For example, sophisticated phishing attacks can ask users to disclose _both_ their password and an OTP code. This type of phishing is more complex because it requires real-time use of compromised credentials. Since OTPs expire after a short time period, it is not possible to stash the stolen credentials for later use. Despite that added complexity, such attacks are not only feasible in principle but they have been [observed in the wild](https://citizenlab.org/2015/08/iran_two_factor_phishing/) against popular 2FA implementations including those used by Google and some large financial services companies.

These risks cannot be addressed by changing how one-time passcodes are generated or delivered. As long as the possibility exists for a user to be tricked into entering codes into the wrong website, phishing remains a viable attack. For these reasons, **_we are continuing to explore alternative 2FA paradigms such as U2F or Authy OneTouch for Gemini_** which are based on fundamentally different models. (Case in point: our _internal_ systems for administering the exchange use public-key authentication with hardware tokens based on the [PIV standard](http://csrc.nist.gov/groups/SNS/piv/standards.html).) Our priority is to find a solution that combines high security and usability, and is available to our customers across a broad range of platforms.

Better Two-Factor Authentication (2FA)

Beginning Friday, November 11, 2016, Gemini will make some small adjustments to its email policy. These changes are designed to keep our customers safe.

Over the last several months we’ve instituted policies for the gemini.com domain (and its subdomains) which signal to the largest email providers to reject email messages that do not originate from sources we have explicitly authorized. Customers whose email providers verify the sender of an email (e.g., Gmail, Yahoo Mail, Hotmail) may rest assured that emails coming from “@gemini.com” have not been sent by anyone else other than Gemini.

While we can say this with confidence for the gemini.com domain, there is little we can do to curb emails coming from look-alike domains or emails which exploit how they are displayed in your inbox. **_Please always take a second look_** at emails which look suspicious. You can contact [support through this link](https://support.gemini.com/hc/en-us/requests/new) to verify an email’s authenticity, and we also encourage you to forward suspicious email messages to [fraud@gemini.com](mailto:fraud@gemini.com).

In addition, in an effort to provide better customer service and an overall friendlier experience, we’ve decided to end our no-link policy. Going forward, we will typically only include links to public blog posts or other information relating to product announcements, and will never include unsolicited links to unaffiliated domains. Regardless, customers should always be careful when clicking on links in emails received from suspicious sources, or emails that just seem out of the ordinary.

Finally, Gemini will **_never_** ask you for your password or login credentials.

Thank you for helping us keep you safe. The security of customers and their assets is our primary concern.

Onward and Upward,

Team Gemini

Gemini Has Modified Its Email Policies

As a next generation Bitcoin exchange, ensuring the security of bitcoin on deposit is Gemini’s top priority. Perhaps more so than credit-cards, ACH or any other payment systems, Bitcoin is the one payment technology where possession of money can be boiled down to pure cryptographic capability: generating a signature with an ECDSA private key _is money_. If you lose control of that private key, you lose the ability to spend your funds, plain and simple.

With adoption of strong cryptography, direct attacks against cryptographic algorithms and protocols have become increasingly rare, although not extinct, as demonstrated by WEP, MD5, GSM encryption and the never-ending saga of TLS vulnerabilities. Far more common, however, are system failures caused by inadequate key management (i.e. when secrets are mishandled) that allow attackers to bypass the cryptography altogether. To that end, Hardware Security Modules (HSMs) have been promoted as best practice for implementing strict control over private keys. An HSM is a special-purpose, tamper-resistant device for managing cryptographic keys. They are not general-purpose computers meant for everyday use or extensibility; there is no Angry Birds app. In fact, there is no keyboard/mouse or an elaborate LCD display for interacting with the device. Instead they must be connected to a trusted client — an ordinary computer that instructs the HSM over a minimalist interface tailored for cryptography — in order to generate new keys, perform specific operations using those keys and destroy said keys when they are no longer needed or desired.

With respect to Bitcoin companies, many offline “cold” vaulting systems (including Gemini’s) utilize HSMs in an “M-of-N” multi-signature security design whereby HSM transaction signers are held in separate, air-gapped, secure physical storage locations. No one particular HSM can spend funds on its own. Instead, a quorum of several HSMs are required to sign and thereby validate a given transaction with their private keys, effectively making the quorum of HSMs the manifestation of funds on deposit (i.e., money held in custody).

Critical to this security design is that secret keys _never leave the HSM itself_; all operations take place within the secure execution environment of the HSM. For example, when decrypting a message, the ciphertext itself is sent to the device, where it is decrypted using the private keys held by (and inside of) the HSM and the decrypted message is returned back. This is distinct from a non-HSM device that actually reveals the private key to the attached trusted client to “borrow” for performing some operation. It is a fundamental design objective of HSMs to never reveal keys, not even to trusted clients when connected.

At Gemini, we have evaluated several different HSM models. One of the first vendors we reached out to was [Safenet](http://www.safenet-inc.com/ "Safenet"), recently acquired by the French conglomerate Gemalto. Safenet produces a [family of HSMs](http://www.safenet-inc.com/data-encryption/hardware-security-modules-hsms/), ranging from USB-attached compact Luna G5 to the network-connected SA7000, which is used by Amazon in its [CloudHSM](http://aws.amazon.com/cloudhsm/ "CloudHSM") offering where AWS customers can lease access to a device. While evaluating the Luna G5, **_we discovered a vulnerability that allows the extraction of secret keys_**_._ As it turns out, the problem is not unique to the G5; it applies to the entire family, including the PCIe version, as well as the networked appliance featured in CloudHSM.

What makes this vulnerability somewhat unusual is that it is a consequence of _following a standard too closely_, as opposed to the more common problem of diverging from established practices. Safenet HSMs are closely based on the [PKCS#11 specification](https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=pkcs11). This is a de facto standard designed to promote interoperability between cryptographic hardware by providing a consistent software interface. Imagine how difficult it would be to write a cryptographic application — such as a Bitcoin wallet — to work with external hardware if each device required a different API for signing a Bitcoin transaction. Certainly, the differences between devices are apparent: some connect over USB while others are addressed over TCP/IP. Each device typically requires a different device driver much like different brands of printers do. But once your HSM is connected, PKCS11 seeks to provide a higher-level point where these differences can be abstracted behind a unified API, with a vendor-provided PKCS#11 module translating the software concepts into the appropriate commands for that brand of hardware.

PKCS #11 defines a series of “mechanisms” that a particular model of hardware can support. These include the usual suspects such as block ciphers (AES, 3DES, etc.) stream ciphers (RC4) keyed-MACs (HMAC, CBC-MAC), asymmetric encryption (RSA), key-agreement (Diffie-Hellman) and digital signatures (RSA again, ECDSA, etc.). PKCS #11, however, does not mandate that a particular mechanism be implemented by a given device, only a way to interrogate the device hardware to determine what is supported. Vendors can also define additional proprietary mechanisms as long as their identifiers do not conflict with the standard. It turns out that Safenet products implement a substantial amount of PKCS #11-defined mechanisms, and that is the problem. Not all of the ideas in PKCS #11 mechanisms are good. In particular, we found that several key derivation mechanisms create weak keys that can be brute-forced easily to recover the original key in a matter of seconds.

Successful exploit requires authenticated access to the HSM, which can be done by subverting the legitimate trusted client that was using the HSM. That may sound like a prohibitive requirement or even tautological — “if your trusted client is compromised, then your cryptographic keys are also compromised.” But HSMs are specifically designed to _survive_ that threat model — the assumption goes that even if an adversary obtains temporary access to the secure physical storage location of the HSM, they can only perform limited operations with the stored key. They can not just ask the HSM to cough up a copy of its stored secrets. This type of vulnerability breaks that model: temporary access can be leveraged to fully exfiltrate both public and private keys and use them in the future, independent of the device.

As a matter of principle, we do not release weaponized exploits or proof-of-concept code that shows how to utilize a given bug. Instead we practice _responsible disclosure_ by working closely with vendors to help them find a solution to fix vulnerabilities, and then publish our findings after a patch is available to the public. We reported the vulnerability to Safenet on **January 30th, 2015**. It was confirmed by the vendor on **February 11th, 2015** and a security update for affected products has been released on **July 9th, 2015**. We plan to publish a follow-up post with additional technical details. For now it’s worth pointing out that the vulnerability affects all symmetric keys and some private-key types, including ECDSA keys used in Bitcoin. **_If you have been using Safenet HSMs for managing Bitcoin keys, your wallet may be at risk._**  Due to the nature of the vulnerability, it is not possible in all cases for customers to work-around the problem without applying the firmware update. In particular, having the HSM set to strict FIPS mode does not mitigate the risk. We encourage customers to upgrade to the latest version released by Safenet \[[Bulletin](http://www.safenet-inc.com/technical-support/security-updates/)\]. Users leasing an HSM via Amazon CloudHSM service should consult specific instructions provided by AWS.

You can find a more detailed description of this vulnerability [here](https://randomoracle.wordpress.com/2015/08/13/safenet-hsm-key-extraction-vulnerability-part-i/).

CVD ID: [2015–5464](http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5464)

The Gemini Blog

Security

MORE SECURITY STORIES