Victims trying to recover money after attacker drains retirement accounts, leaves only "crypto dust"

BY KERRY TOMLINSON, AMPERE NEWS

February 18, 2022

The latest update from IRA Financial brings bad news for victims of a $36 million retirement account hack.

The retirement account company announced today that only a small amount of the missing money can be recovered after the February 8 theft. That leaves an estimated 30 people wondering if they will get their life savings back.

IRA Financial specializes in cryptocurrency retirement accounts. Cryptocurrency is like digital money. IRA stands for 'individual retirement account,' a way for people to save money for retirement and save some money on taxes.

Here is one victim's story.

Watch here:

Life Savings

Jim Feely spent 18 years saving up money in his IRA account --- a special version called a ROTH account --- reaching six figures last year.

"It's money that I got from budgeting and not partying too much when I was young," he said to Ampere News.

He put it all into IRA Financial, a company that allows you to convert your retirement savings into cryptocurrency. But on February 8, his money disappeared.

"It takes a lot of money, a lot of time to build up a meaningful amount of money for an IRA. Eighteen years gone and an hour-and-a-half," he said.

How did it happen?

Feely contacted me, a former co-worker, to tell his story. He and other victims estimate around 30 people received a message from IRA Financial on February 10 about "suspicious activity."

"I went and logged into my account. And sure enough, I was affected by some kind of theft. Because my account was down to almost zero," he said.

The victims believe that someone using an administrator account for IRA Financial entered their accounts illegally and transferred their money, first to a different IRA account and then out. They left behind only "crypto dust," small amounts of cryptocurrency that amount to very little.

"It's pretty shocking to see that," Feely said.

IRA Financial Response

IRA Financial told victims they launched an investigation, contacted state and federal law enforcement, and are working with third-party forensic specialists to figure out what went wrong.

"We share our customers’ intense concern regarding this incident, and sincerely apologize both for how upsetting this is, and for any ensuing delays as we continue our investigation," the company said in a message to customers affected.

But the victims still have questions. Will IRA Financial refund their money, or maybe Gemini, the cryptocurrency platform that IRA Financial uses --- and where the illegal access took place?

"I mean, we're not going to be on the streets because of this, but it still hurts. It's all that all that money I saved all those years, it's just gone. And these companies are saying, 'Oh, no, sorry,'" said Feely.

Protection?

The IRA Financial site says it has FDIC [Federal Deposit Insurance Corporation] protection of cash up to $250,000. And in a January video, company head Adam Bergman emphasizes that the company is insured.

But in the question-and-answer section below the video, the company clarifies that the FDIC insurance is only for cash at a bank, not for money in cryptocurrency on the Gemini platform.

The comment goes on to say that Gemini is regulated and insured against theft, "so your cryptos are protected."

Not so fast.

Gemini

Gemini told victims that it is not responsible because the illegal transfers "complied with IRA's approval processes" and the cryptocurrency platform "found no indication of any unauthorized access to your account resulting from any security failure or breach of Gemini systems."

The company urges victims to contact IRA Financial directly to "determine what insurance they may have to cover this loss."

"Oh, man, I think I just lost all my money and nobody's going to help," Feely said. "So, it's pretty, pretty awful."

Questions

Feely said he invested based on IRA Financial's assurances in videos and online and Gemini's reputation as a secure company. Now he's wondering what went wrong.

For example, he asks, if IRA Financial claims on its site that it requires multiple signatures to move money, how did the attacker raid the accounts? And why he didn't receive notifications that his money was moving as his account specified.

He recommends, for now, that people wait to invest their retirement in cryptocurrency.

"Crypto seems like a really great diversification. for retirement. I think it made sense to put a little bit of your retirement money in there," he said. "It probably still makes sense to do that, but maybe in three or four years."

"I wouldn't recommend that anybody put an IRA in crypto at this time," he added.

Help Wanted

Are there any laws that requirement IRA companies to reimburse their customers in case of theft?

Ampere News checked with multiple government agencies and retirement and consumer experts. No one was able to find a law that protects you if a thief drains your retirement account.

Consumer program director Ed Mierzwinski at US Public Interest Research Group said crooks are turning their attention to retirement accounts, rather than bank accounts and credit cards, because there may be a lack of protection. Also, he said, people don't check their retirement accounts as often, giving thieves more time to cover their tracks.

He recommends you:

Ask your plan what it does to protect your money from cyber-thieves.
Ask your plan to use two-factor authentication, the extra login step (like a code sent to your phone).
Guard your retirement account password carefully.
Read your statements regularly.

Many money experts recommend people do a lot of research before investing in cryptocurrency, and don't put all your retirement money into it.

Still investigating

In its February 18 announcement, IRA Financial said it is "actively exploring all potential avenues to address victims’ losses."

The company said it has submitted a claim to its insurers but has not been able to confirm that any losses will be covered.

"We are devoting all our attention to address and resolve this matter as quickly as possible," company head Adam Bergman said in a letter to victims. "This is a difficult situation that we understand is outside your control. And as I said earlier, I am doing all I can personally to dedicate all available resources toward this effort."