INX's third-party vendor serving one of the company's subsidiaries was compromised, allowing a malicious actor to execute unauthorized trades on the vendor's servers. The attacker drained approximately $1.6M from the subsidiary before being discovered.