Hackers obtained IRA Financial's master API key from unencrypted emails between Gemini and IRA, which contained a single point of failure that bypassed security protocols. The attackers consolidated funds from all sub-accounts into one and withdrew approximately $36M in Bitcoin and Ether within a two-hour window before Gemini could freeze accounts.