Multiple users reached out to Cointelegraph, alleging that the leak, which Gemini attributes to a "third-party incident," happened much earlier than first expected. 

In one thread dating back to November, user DaveJonesBones claimed that he received a targeted phishing email from an address that was only registered on Gemini:

"It promoted a Cyberbroker NFT drop using Opensea branding. I think I also received one last month, but I deleted it without reading it. Today, I got the hump because I'd specifically opted-out to all marketing emails from Gemini."

To which a Gemini representative responded:

"Reporting this to our security team. Thank you for letting us know."

In another thread titled "Gemini is compromised. Gemini user data is being used for complex phishing attempts" from two weeks prior, user Exit_127 claimed he received a phishing email from a Metamask imposter regarding the need to "sync my wallet due to the merge." The user also claimed that "I use email aliases so each online account has a specific email linked to it. This phishing attempt went to the email used by and only by my Gemini account."