A phishing attack on Retool led to the theft, which helped spur Fortress Trust’s agreement to sell itself to Ripple, sources said.