A fake security warning flashed across crypto wallets, sending users scrambling to protect their funds. Instead, the alert delivered them straight to thieves who drained roughly $2.56 million, exploiting a trusted notification system without ever cracking the hardware itself.
Key Takeaways
- Ngrave traced approximately $2.56 million stolen from 70 wallet addresses across four blockchain networks.
- Ngrave said its ZERO hardware remained secure while phishing victims surrendered wallet recovery credentials.
- Ngrave’s CEO admitted the company had “absolutely and utterly failed” its fundamental security obligation.
A Fake Security Alert With a $2.56 Million Price Tag
Belgian hardware-wallet maker Ngrave, commonly known as NGRAVE, disclosed on Oct. 19 that attackers hijacked a third-party notification provider serving its LIQUID companion app. The breach allowed criminals to send authentic-looking security warnings directly to customers on Oct. 17. The message claimed a user’s portfolio had been synchronized with a Pixel 9 device in Moscow. Clicking the alert opened a counterfeit Ngrave website featuring a countdown timer and an ominous choice to approve or deny the suspicious activity.
Both paths led to the same trap. Users were prompted to enter their 24-word recovery phrase or Perfect Key, handing attackers everything needed to recreate their wallets. Automated scripts emptied compromised accounts within minutes. Ngrave’s investigation traced approximately $2.56 million stolen from 70 wallet addresses across four networks. Bitcoin accounted for $1.77 million, followed by $454,000 in XRP, $316,000 in Ethereum-based assets and $18,000 in Stellar.
Attackers Exploited Notification Keys, Not Hardware
The company’s incident report reveals that unauthorized access potentially began Oct. 11, six days before the fraudulent notifications appeared. Attackers obtained one access key and leveraged it to acquire another with broader permissions, including access to certain analytics information. Ngrave detected the malicious alerts within a minute of their appearance at 9:30 p.m. UTC on Oct. 17. Nevertheless, the first wallet was drained six minutes later.
The company disabled its notification system by 10:45 p.m., but thefts continued from previously compromised wallets until 3:51 a.m. the following morning. Crucially, Ngrave maintains its ZERO hardware wallets and private keys remained untouched. The criminals instead manipulated customers into surrendering their own credentials.
Ngrave CEO Admits Company ‘Absolutely and Utterly Failed’
The stolen funds traveled through exchanges, blockchain bridges, and fresh addresses. Ngrave traced bitcoin into 12 addresses, while XRP moved through 54 transfers. The company also acknowledged potential exposure of device information, wallet activity, IP addresses, and approximate locations, raising concerns about subsequent targeted scams.
The analytics firm Bitquery also published a report on the matter, noting that, in terms of the stolen funds, “most of it now sits on Hyperliquid as a Monero token.” The Bitquery report estimates around 81% found its way to the popular perps DEX exchange. In the incident report, Ngrave’s senior executive spoke on the matter.
Its CEO offered an unusually candid assessment, stating:
“In my humble opinion, the first duty of a crypto security company is to provide exactly that: security. In this, we have absolutely and utterly failed.”
He acknowledged that the company’s security posture was inadequate when he assumed leadership months earlier. Ngrave has since replaced compromised keys and outlined tighter notification controls, including two-person approvals, restricted domains and emergency shutdown capabilities.
Affected customers are being urged to establish fresh wallets and contact support. The investigation continues, leaving a troubling distinction intact: the hardware held firm, but the trusted messages surrounding it became the weapon.
It’s been a tough year for hardware wallet makers as 2026 has been riddled with security issues. Nearly a dozen documented hardware-wallet security incidents involving Ledger, Trezor, Tangem, Safepal, Bitbox02, and Coldcard. Reported losses exceeded $180 million across two incidents, exposing vulnerabilities in firmware, third-party vendors, physical security, and phishing, rather than direct remote attacks on recovery phrases.