Main navigation

Identity of Ripple's Fortress Trust Hacker Who Stole $15 Million in Crypto Revealed

Mon, 09/18/2023 - 11:19
article image
Yuri Molchan
Details of exploit that drained $15 million worth of crypto from Fortress Trust have emerged thanks to Retool company, here's who hacker may be
Identity of Ripple's Fortress Trust Hacker Who Stole $15 Million in Crypto Revealed
Cover image via
Read U.TODAY on
Google News

Chinese crypto blogger and journalist Colin Wu has shared the details of the recent hack of crypto custodian Fortress Trust, just recently acquired by Ripple blockchain giant. It became possible thanks to software developing company Retool, citing a story by

The soft spot hit by the hackers here, according to Wu, was to do with the additional security system provided by a major authentication app.

27 accounts on Fortress Trust were compromised

According to Retool, the cyber criminals managed to compromise as many as 27 accounts on Fortress Trust crypto custody company. They succeeded in making this exploit after a targeted SMS (text)-based social engineering attack.

According to Fortress Trust, the hackers used a Google account cloud synchronization feature that was introduced in the spring of this year. The company, based in San Francisco just like Ripple that bought it, stated that the feature mentioned above made the breach worse and referred to it as a "dark pattern." Retool called this type of synchronization "a novel attack vector," per the head of engineering at the company, Snir Kodesh. He stated that this multi-factor-authentication turned into single factor thanks to the update made by the internet search giant in April.

The attack that occurred on Aug. 27 happened at the same time that Fortress Trust was moving its logins to Okta.

TikTok Battling Influx of Elon Musk Crypto Scams

Here's how attack began, and here's who stands behind it

The hackers pretended to be one of the Fortress Trust IT team members when they started their SMS-phishing attack. They gave the recipients directions to follow a link that looked quite legitimate in order to help them with a payroll-related problem.

One real staff member fell for this trick and went to a fake landing page, which then had them share their credentials. What happened next is that the villains again rang the same employee, pretending to be a member of the IT team (with the help of deep fake changing their voice) and told the staffer to pass them the code of multi-factor authentication (MFA).

This code let the hackers add their own gadget to the Okta account of the victim, and after that, the culprits were able to make up their own MFA codes to access the account. In the end, having put smoke in the eyes of this employee, the hackers were further able to access all the 27 accounts mentioned above. The hackers changed the email addresses for those accounts, along with the passwords. As a result, a whopping $15 million worth of crypto assets was lost.

The way the attack was performed shows similar methods to the hacker calling himself Scattered Spider (aka UNC3944), who is believed to be an expert of a high level in phishing attacks.

article image
About the author

Yuri is a crypto journalist interested in technology and technical innovations. He has been in crypto since 2017. Believes that blockchain and cryptocurrencies have a potential to transform the world in the future in many of its aspects. ‘Hodls’ major cryptocurrencies and has written for multiple crypto media outlets. 

His articles have been quoted by such crypto influencers as Tyler Winklevoss, John McAfee, CZ Binance, Max Keiser, etc.

Currently Yuri is a news writer at U.Today and can be contacted at