# Deepfaked voice in Retool breach linked to about $15m crypto theft at Fortress Trust Source: https://www.bankingnewsai.com/ai-incidents/fortress-trust-2023-retool-deepfake-voice-breach Last updated: Oct 21, 2026 Fortress Trust and Retool · AI used against the institution · severity 3 of 5 Software vendor Retool said in September 2023 that an attacker who phished one of its employees by text on 27 August 2023 then phoned the employee, claimed to be from IT and "deepfaked our employee's actual voice" to obtain a multi-factor authentication code, leading to the takeover of 27 crypto-industry cloud customer accounts. CoinDesk reported that Retool was the unnamed third-party vendor Fortress Trust had blamed for a theft of customers' crypto that it reported at close to $15 million. Fortress CEO Scott Purcell told Fortune the firm lost $12 million to $15 million from four customers and "covered it right away"; according to CoinDesk, Ripple, which was buying Fortress, helped make customers whole. Fortress has not publicly confirmed that Retool was the vendor. ## Key facts | | | | --- | --- | | Date | Aug 27, 2023 (disclosed Sep 13, 2023) | | Institution | Fortress Trust and Retool | | Country | United States | | AI system | Deepfaked voice used on a phone call to obtain a multi-factor authentication code | | AI? | Described as AI by the institution or regulator — The institution, a regulator or a court called the system AI. | | Category | Voice clone (AI used against the institution) | | Status | Reported | | Severity | 3 of 5 — Material harm: Fortress Trust's CEO put the theft at $12 million to $15 million in crypto from four customers, and 27 Retool cloud customers had accounts taken over; customers were reimbursed and no regulatory action has been reported. | ## What happened? Retool, a San Francisco software company, wrote on 13 September 2023 that it "fell victim to a spear phishing attack" on 27 August 2023. Several employees received texts claiming to come from IT about an account issue; one logged in to a fake identity portal. The attacker then called that employee, "claimed to be one of the members of the IT team, and deepfaked our employee's actual voice", and obtained one additional multi-factor authentication code, Retool said. [1][4] According to Retool, the extra code let the attacker add a device to the employee's Okta account; because the employee's Google Authenticator codes were synced to the cloud, the attacker gained the codes needed for Retool's VPN and internal admin systems. From there the attacker ran "an account takeover attack on a specific set of customers (all in the crypto industry)", changing users' emails and resetting passwords. Retool notified 27 cloud customers on 29 August 2023 and said no on-premise or managed accounts were affected. [1][5] Fortress Trust, a Nevada-chartered crypto trust company and custodian, said on 7 September 2023 that four of its customers had been affected by a third-party vendor whose cloud tools were compromised, and at the time said there had been "no loss of funds", according to Fortune and CoinDesk. On 12 September CEO Scott Purcell told Fortune the firm had lost $12 million to $15 million in crypto, mostly Bitcoin. [2][3] On 13 September 2023 CoinDesk reported, citing people familiar with the matter, that the vendor was Retool, which had built the portal some Fortress clients used to reach their funds. Retool referred CoinDesk to its blog post, which does not name Fortress. Fortress's wallet providers Fireblocks and BitGo said their own systems were not breached, according to CoinDesk. [2][4] ## Timeline - Aug 27, 2023 — A Retool employee is phished by text and then called by an attacker using a deepfaked voice, who obtains an MFA code and takes over 27 crypto-industry cloud customer accounts. [1] - Aug 29, 2023 — Retool notifies the 27 affected cloud customers of unauthorized access to their accounts. [1] - Sep 7, 2023 — Fortress Trust discloses that four customers were affected by a compromised third-party vendor, saying at the time there was no loss of funds. [2][3] - Sep 8, 2023 — Ripple announces it will acquire Fortress Trust; Ripple later said the security incident accelerated the talks. [2][3] - Sep 12, 2023 — Fortress CEO Scott Purcell tells Fortune the firm lost $12 million to $15 million in crypto. [3] - Sep 13, 2023 — Retool publishes its account of the attack; CoinDesk identifies Retool as the vendor behind the Fortress theft. [1][2] ## What was the impact? - Financial: $12 million to $15 million in crypto (Fortress CEO to Fortune); CoinDesk put it at close to $15 million - Customers: Four Fortress Trust customers; 27 Retool cloud customer accounts taken over - Other: Customers were reimbursed: a Ripple spokesperson said Fortress covered most affected customers and Ripple "stepped in to make the rest of those customers whole" within a week. [1][2][3] ## How did Fortress Trust and Retool respond? Fortress CEO Scott Purcell told Fortune: "It was $12 to $15 million out of billions, and we covered it right away," and said fault lay with the third-party vendor, not Fortress or its custody partners. Fortress did not name the vendor. Retool said it revoked all internal authenticated sessions, locked down and restored the 27 affected accounts, notified customers, was working with law enforcement and a forensics firm, and urged FIDO2 hardware keys and human-in-the-loop checks "given deepfakes". [1][3] ## What was the outcome? Affected customers were made whole, with Ripple contributing as part of its acquisition of Fortress Trust, according to CoinDesk and Fortune. Purcell told Fortune the FBI, the Secret Service and regulators were involved; no charges, regulatory finding or enforcement action tied to the theft had been reported as of 2026-10-21. [2][3] ## FAQ ### Was a deepfake really used in the Retool and Fortress Trust breach? Retool itself said so: in its September 2023 write-up it said the caller who obtained the multi-factor code "deepfaked our employee's actual voice". No recording has been published, and Fortress Trust never publicly named Retool as the vendor; CoinDesk identified Retool through people familiar with the matter. ### How much money was lost in the Fortress Trust hack? Fortress Trust CEO Scott Purcell told Fortune the firm lost $12 million to $15 million in crypto, mostly Bitcoin with small amounts of USDC and USDT, from four customers. CoinDesk reported the total at close to $15 million. Customers were reimbursed by Fortress and Ripple. ### Did customers get their money back after the Fortress Trust theft? Yes, according to CoinDesk a Ripple spokesperson said Fortress covered most affected customers and Ripple stepped in to make the rest whole within a week; Fortune reported Ripple said the amount used to cover customer funds was baked into its acquisition of Fortress. ### What did Retool change after the deepfake phishing attack? Retool said it revoked all internal sessions, restored the 27 taken-over accounts, and engaged law enforcement and a forensics firm. It recommended FIDO2 hardware security keys over one-time codes and said it had added human-in-the-loop checks for important internal actions, noting even those are not sufficient given deepfakes. ## Sources 1. [When MFA isn't actually MFA](https://retool.com/blog/mfa-isnt-mfa) — Retool, Sep 13, 2023 (news): "The caller claimed to be one of the members of the IT team, and deepfaked our employee's actual voice. The voice was familiar with the floor plan of the office, coworkers, and internal processes of the company." 2. [Phishing Attack on Cloud Provider With Fortune 500 Clients Led to $15M Crypto Theft From Fortress Trust](https://www.coindesk.com/business/2023/09/13/phishing-attack-on-cloud-provider-with-fortune-500-clients-led-to-15m-crypto-theft-from-fortress-trust/) — CoinDesk, Sep 13, 2023 (news): "The vendor is Retool, a San Francisco-based company with Fortune 500 customers, which built the portal for a handful of Fortress clients to access their funds, people familiar with the matter said." 3. [Fortress CEO says hackers stole up to $15 million, mostly in Bitcoin, prior to Ripple acquisition](https://fortune.com/crypto/2023/09/12/fortress-trust-12-to-15-million-hack-bitcoin-usdc-usdt-ripple/) — Fortune, Sep 12, 2023 (news): ""It was $12 to $15 million out of billions, and we covered it right away," he told Fortune ... "It was only really four customers out of 225,000 customers."" 4. [Attackers hit software firm Retool to get to crypto companies and assets](https://www.helpnetsecurity.com/2023/09/14/retool-breach/) — Help Net Security, Sep 14, 2023 (security research): "Retool, the company behind the popular development platform for building internal business software, has suffered a breach that allowed attackers to access and take over accounts of 27 cloud customers, all in the crypto industry." 5. [Google Feature Blamed for Retool Breach That Led to Cryptocurrency Firm Hacks](https://www.securityweek.com/google-feature-blamed-for-retool-breach-that-led-to-cryptocurrency-firm-hacks/) — SecurityWeek, Sep 15, 2023 (security research) All AI incidents at banks: https://www.bankingnewsai.com/ai-incidents --- Canonical page: https://www.bankingnewsai.com/ai-incidents/fortress-trust-2023-retool-deepfake-voice-breach Part of [BankingNewsAI](https://www.bankingnewsai.com/) — the register of AI incidents at banks: https://www.bankingnewsai.com/ai-incidents. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.