Forensic investigation into the Feb 2015 theft of 18,866 bitcoins (approx USD5.2m) from the Bitstamp Bitcoin exchange, as a result of successful spear phishing targeting their employees.
https://bitstampincidentreport.files.wordpress.com/2015/07/270137312-bitstamp-incident-report-2-20-15.pdf
Start on page 9 for the action.
Something of a writeup at
which links to Reddit discussion at