Ngrave says phishing via hijacked alerts stole $2.56m from 70 wallets

Key points

• Ngrave traced about $2.56m stolen from 70 wallet addresses across four networks, with $1.77m in Bitcoin and $454,000 in XRP.
• Attackers gained access to a notification provider key as early as 11 Oct and sent the fake alerts at 9:30 p.m. UTC on 17 Oct.
• Ngrave's CEO said the company had "absolutely and utterly failed" its core security duty, though the ZERO hardware was not breached.

Ngrave says a phishing attack that hijacked its alert system stole about $2.56m from customers, after fake security warnings pushed users to hand over their recovery phrases. The Belgian hardware-wallet maker disclosed the incident on 19 Oct, saying attackers had taken over a third-party notification provider used by its LIQUID companion app.

The fraudulent messages went out on 17 Oct and claimed a user's portfolio had been synchronised with a Pixel 9 device in Moscow. Clicking through led to a counterfeit Ngrave site with a countdown timer and a choice to approve or deny the activity; either path asked for the 24-word recovery phrase or Perfect Key. Automated scripts then emptied the wallets within minutes.

Unauthorised access may have begun on 11 Oct, when attackers obtained one key and used it to gain broader permissions. Ngrave spotted the alerts within a minute of 9:30 p.m. UTC and shut the notification system by 10:45 p.m., but thefts continued until 3:51 a.m. the next morning.

The company says its ZERO hardware wallets and private keys were not compromised. Its CEO said the firm had "absolutely and utterly failed" its duty to provide security, and Ngrave has replaced compromised keys and added two-person approvals and emergency shutdown controls. Bitquery estimates around 81% of the funds now sit on Hyperliquid as a Monero token.

What to watch: Ngrave says its investigation continues and is urging affected customers to set up fresh wallets and contact support.

Read the full story on Bitcoin.com News →