Citadel voice deepfake — Aug 2026

In August 2026, attackers targeted employees at major hedge funds, including Citadel, Point72, and Two Sigma, using sophisticated voice-cloning technology. The attackers attempted to gain unauthorized access to the firms' internal systems by impersonating known individuals during phone calls.

What happened

The attackers leveraged the familiarity of voices to bypass standard security perceptions, combining cloned audio with a sense of urgency to pressure employees. By mimicking the voices of trusted individuals and utilizing spoofed caller ID information, the attackers aimed to persuade help desk staff to perform sensitive actions, such as resetting passwords or transferring multi-factor authentication (MFA) tokens to attacker-controlled devices. The strategy relied on the assumption that a familiar-sounding voice, paired with a plausible reason for haste, would discourage staff from performing rigorous verification. This incident highlights the vulnerability of relying on voice recognition and caller ID as primary authentication signals, as both have become increasingly easy to manipulate through synthetic media and technical spoofing.