ChainBleedv0.1 · open intel
← back to feed·BITCOIPHISHING2023-09-07 · 2y ago
Incident · SLOWMIST

Fortress

Third-party Vulnerability
Estimated loss
$15.00M
VERDICT —OUT OF SCOPE
Root cause is phishing — victims signed malicious transactions or approvals off-protocol. Contract logic was not the failure surface; user-side wallet hygiene was. Pre-deployment audit cannot catch this class.
▰ METHOD
PHISHING
PHISHING
Root cause

Root-cause analysis not yet published. The incident description below contains all currently available signal — review the attack transaction directly for definitive forensics.

Forensic narrative

On September 7, crypto trust company Fortress said on twitter that its customers were affected by a "compromised third-party provider of cloud tools," but that there was no loss of funds. On September 13, Fortress Trust founder and CEO Scott Purcell said that the company lost $12 million to $15 million in cryptocurrencies in a recent hack, most of which was Bitcoin but two stablecoins. A small amount of USDC and USDT were also stolen, and the company immediately made up for the loss. "Of the 225,000 customers, only 4 customers were actually affected." Purcell repeatedly emphasized that the fault of the security breach lies with the third-party provider, not the Fortress Trust or the company's hosting partners Fireblocks or BitGo. The vendor has been identified as Retool, and Retool admitted that it was the victim of a phishing attack. Attack method (per SlowMist): Third-party Vulnerability. Reported loss: $ 15,000,000.

Primary source
https://fortune.com/crypto/2023/09/12/fortress-trust-12-to-15-million-hack-bitcoin-usdc-usdt-ripple/
Sourced from
slowmist
Technical record
chain
bitcoin
protocol
Fortress
bug_class
phishing
date_occurred
2023-09-07
loss_usd
$15,000,000
source_id
sm:fortress::2023-09-07
Related — same bug class· phishing
2026-04-29
1mo ago
Sweat Foundation
Contract Vulnerability
phishing
$3.50M
OUT OF SCOPE
2026-04-28
1mo ago
ETH
Multicall yvETH Approval Abuse (victim 0x9828)
Approval-drainer via multicall aggregator (phishing pattern)
phishing
$980.1K
OUT OF SCOPE
2026-04-27
1mo ago
ETH
Unverified Contract 0x2990A16D
Stale approval drain on unverified contract
phishing
$229.0K
OUT OF SCOPE
2026-04-03
2mo ago
Adobe
Supply Chain Attack
phishing
OUT OF SCOPE
2026-04-02
2mo ago
Trust Wallet
Infrastructure Hijacking
phishing
OUT OF SCOPE
2025-12-04
6mo ago
USPD
"CPIMP" (Clandestine Proxy In the Middle of Proxy) attack
phishing
$1.00M
OUT OF SCOPE
ChainBleed — live web3 threat intelligence