Fortress Trust and Retool · AI used against the institution · severity 3 of 5
Software vendor Retool said in September 2023 that an attacker who phished one of its employees by text on 27 August 2023 then phoned the employee, claimed to be from IT and "deepfaked our employee's actual voice" to obtain a multi-factor authentication code, leading to the takeover of 27 crypto-industry cloud customer accounts. CoinDesk reported that Retool was the unnamed third-party vendor Fortress Trust had blamed for a theft of customers' crypto that it reported at close to $15 million. Fortress CEO Scott Purcell told Fortune the firm lost $12 million to $15 million from four customers and "covered it right away"; according to CoinDesk, Ripple, which was buying Fortress, helped make customers whole. Fortress has not publicly confirmed that Retool was the vendor.
Record last reviewed Oct 21, 2026 · Markdown
Date
Aug 27, 2023 · disclosed Sep 13, 2023
Institution
Fortress Trust, Retool
Country
United States
AI system
Deepfaked voice used on a phone call to obtain a multi-factor authentication code
AI?
Described as AI by the institution or regulator
The institution, a regulator or a court called the system AI.
Category
Status
Reported
Severity
3 of 5
Impact
$12 million to $15 million in crypto (Fortress CEO to Fortune); CoinDesk put it at close to $15 million · ≈ $15 million · Four Fortress Trust customers; 27 Retool cloud customer accounts taken over · Customers were reimbursed: a Ripple spokesperson said Fortress covered most affected customers and Ripple "stepped in to make the rest of those customers whole" within a week.
What happened?
Retool, a San Francisco software company, wrote on 13 September 2023 that it "fell victim to a spear phishing attack" on 27 August 2023. Several employees received texts claiming to come from IT about an account issue; one logged in to a fake identity portal. The attacker then called that employee, "claimed to be one of the members of the IT team, and deepfaked our employee's actual voice", and obtained one additional multi-factor authentication code, Retool said.[1][4]
According to Retool, the extra code let the attacker add a device to the employee's Okta account; because the employee's Google Authenticator codes were synced to the cloud, the attacker gained the codes needed for Retool's VPN and internal admin systems. From there the attacker ran "an account takeover attack on a specific set of customers (all in the crypto industry)", changing users' emails and resetting passwords. Retool notified 27 cloud customers on 29 August 2023 and said no on-premise or managed accounts were affected.[1][5]
Fortress Trust, a Nevada-chartered crypto trust company and custodian, said on 7 September 2023 that four of its customers had been affected by a third-party vendor whose cloud tools were compromised, and at the time said there had been "no loss of funds", according to Fortune and CoinDesk. On 12 September CEO Scott Purcell told Fortune the firm had lost $12 million to $15 million in crypto, mostly Bitcoin.[2][3]
On 13 September 2023 CoinDesk reported, citing people familiar with the matter, that the vendor was Retool, which had built the portal some Fortress clients used to reach their funds. Retool referred CoinDesk to its blog post, which does not name Fortress. Fortress's wallet providers Fireblocks and BitGo said their own systems were not breached, according to CoinDesk.[2][4]
When did it happen?
- Aug 27, 2023
A Retool employee is phished by text and then called by an attacker using a deepfaked voice, who obtains an MFA code and takes over 27 crypto-industry cloud customer accounts.[1]
- Aug 29, 2023
Retool notifies the 27 affected cloud customers of unauthorized access to their accounts.[1]
- Sep 7, 2023
Fortress Trust discloses that four customers were affected by a compromised third-party vendor, saying at the time there was no loss of funds.[2][3]
- Sep 8, 2023
Ripple announces it will acquire Fortress Trust; Ripple later said the security incident accelerated the talks.[2][3]
- Sep 12, 2023
Fortress CEO Scott Purcell tells Fortune the firm lost $12 million to $15 million in crypto.[3]
- Sep 13, 2023
Retool publishes its account of the attack; CoinDesk identifies Retool as the vendor behind the Fortress theft.[1][2]
What was the impact?
- Financial: $12 million to $15 million in crypto (Fortress CEO to Fortune); CoinDesk put it at close to $15 million · ≈ $15 million[1][2][3]
- Customers: Four Fortress Trust customers; 27 Retool cloud customer accounts taken over[1][2][3]
- Other: Customers were reimbursed: a Ripple spokesperson said Fortress covered most affected customers and Ripple "stepped in to make the rest of those customers whole" within a week.[1][2][3]
Severity 3 of 5: Material harm: Fortress Trust's CEO put the theft at $12 million to $15 million in crypto from four customers, and 27 Retool cloud customers had accounts taken over; customers were reimbursed and no regulatory action has been reported.
How did Fortress Trust and Retool respond?
Fortress CEO Scott Purcell told Fortune: "It was $12 to $15 million out of billions, and we covered it right away," and said fault lay with the third-party vendor, not Fortress or its custody partners. Fortress did not name the vendor. Retool said it revoked all internal authenticated sessions, locked down and restored the 27 affected accounts, notified customers, was working with law enforcement and a forensics firm, and urged FIDO2 hardware keys and human-in-the-loop checks "given deepfakes".[1][3]
What was the outcome, and did regulators act?
Affected customers were made whole, with Ripple contributing as part of its acquisition of Fortress Trust, according to CoinDesk and Fortune. Purcell told Fortune the FBI, the Secret Service and regulators were involved; no charges, regulatory finding or enforcement action tied to the theft had been reported as of 2026-10-21.[2][3]
Was a deepfake really used in the Retool and Fortress Trust breach?
Retool itself said so: in its September 2023 write-up it said the caller who obtained the multi-factor code "deepfaked our employee's actual voice". No recording has been published, and Fortress Trust never publicly named Retool as the vendor; CoinDesk identified Retool through people familiar with the matter.
How much money was lost in the Fortress Trust hack?
Fortress Trust CEO Scott Purcell told Fortune the firm lost $12 million to $15 million in crypto, mostly Bitcoin with small amounts of USDC and USDT, from four customers. CoinDesk reported the total at close to $15 million. Customers were reimbursed by Fortress and Ripple.
Did customers get their money back after the Fortress Trust theft?
Yes, according to CoinDesk a Ripple spokesperson said Fortress covered most affected customers and Ripple stepped in to make the rest whole within a week; Fortune reported Ripple said the amount used to cover customer funds was baked into its acquisition of Fortress.
What did Retool change after the deepfake phishing attack?
Retool said it revoked all internal sessions, restored the 27 taken-over accounts, and engaged law enforcement and a forensics firm. It recommended FIDO2 hardware security keys over one-time codes and said it had added human-in-the-loop checks for important internal actions, noting even those are not sufficient given deepfakes.
- When MFA isn't actually MFA news
- Phishing Attack on Cloud Provider With Fortune 500 Clients Led to $15M Crypto Theft From Fortress Trust news
- Fortress CEO says hackers stole up to $15 million, mostly in Bitcoin, prior to Ripple acquisition news
- Attackers hit software firm Retool to get to crypto companies and assets security research
- Google Feature Blamed for Retool Breach That Led to Cryptocurrency Firm Hacks security research
When AI goes wrong at a bank, the next morning's brief says so.
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning