Key Takeaways
- • A US investment firm lost $1.5 million in cryptocurrency after cybercriminals compromised its Microsoft 365 environment and hijacked business email conversations, according to a case study published by cybersecurity firm J2 Software on October 14.
- • Attackers created Outlook rules to intercept emails about a planned crypto investment, altered transaction details, and sent messages from spoofed addresses that closely resembled the legitimate counterparty's.
- • The firm made a small test transfer, then authorised the larger payment after attackers confirmed receipt; the fraud surfaced only when the genuine investment company asked why funds had not arrived.
- • No trading platform or crypto exchange was breached; the attack exploited trust in business email communications, a business email compromise (BEC) pattern.
- • More than a year after the incident, the firm was still pursuing recovery of the stolen funds through legal proceedings, per J2.
Summary
A US investment firm lost $1.5 million in cryptocurrency after cybercriminals gained access to its Microsoft 365 environment, manipulated its Outlook settings and tricked the business into sending funds to the wrong destination, according to a case study published by cybersecurity company J2 Software on October 14. The attack did not involve breaching a trading platform or cryptocurrency exchange. Instead, attackers exploited trust in business email communications to make the fraudulent transaction appear legitimate.
According to J2, the attackers created rules to intercept emails related to a planned cryptocurrency investment, altered transaction details and sent messages that appeared to come from the genuine investment counterparty. Subtle changes to email addresses made the deception difficult to detect, particularly because the sender's display name looked more prominent than the actual address.
The firm first transferred a small amount of cryptocurrency as a test. After the attackers confirmed receipt, the business was instructed to send the remaining investment, and it authorised the larger payment believing it was communicating with its real partner. The fraud came to light only when the legitimate investment company contacted the firm to ask why the funds had not arrived. Both parties then discovered that criminals had effectively run two separate conversations, leaving each side unaware of the deception.
Following the incident, the firm removed the unauthorised Outlook rules and engaged J2 Software to investigate and secure its Microsoft 365 environment. Measures included tightening access controls, addressing security misconfigurations and adding monitoring to detect suspicious activity and potential account takeovers. The company subsequently retained J2 for ongoing cybersecurity support.
Recovering the stolen cryptocurrency has proved difficult. More than a year after the incident, the firm was still pursuing the funds through legal proceedings, according to J2. The case illustrates how business email compromise can cause major losses without directly breaching financial platforms, as criminals who control trusted communications can manipulate legitimate payment processes and persuade victims to authorise transfers themselves.
According to J2, the attackers created rules to intercept emails related to a planned cryptocurrency investment, altered transaction details and sent messages that appeared to come from the genuine investment counterparty. Subtle changes to email addresses made the deception difficult to detect, particularly because the sender's display name looked more prominent than the actual address.
The firm first transferred a small amount of cryptocurrency as a test. After the attackers confirmed receipt, the business was instructed to send the remaining investment, and it authorised the larger payment believing it was communicating with its real partner. The fraud came to light only when the legitimate investment company contacted the firm to ask why the funds had not arrived. Both parties then discovered that criminals had effectively run two separate conversations, leaving each side unaware of the deception.
Following the incident, the firm removed the unauthorised Outlook rules and engaged J2 Software to investigate and secure its Microsoft 365 environment. Measures included tightening access controls, addressing security misconfigurations and adding monitoring to detect suspicious activity and potential account takeovers. The company subsequently retained J2 for ongoing cybersecurity support.
Recovering the stolen cryptocurrency has proved difficult. More than a year after the incident, the firm was still pursuing the funds through legal proceedings, according to J2. The case illustrates how business email compromise can cause major losses without directly breaching financial platforms, as criminals who control trusted communications can manipulate legitimate payment processes and persuade victims to authorise transfers themselves.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.