NGRAVE users lose millions after fake app security alerts

What happened

NGRAVE disclosed on Oct. 19 that attackers had compromised access to a third-party service that delivers push notifications for its LIQUID companion app. On Oct. 17, fraudulent messages told users their portfolios had been synchronized with a Pixel 9 device in Moscow. The alerts led to a counterfeit NGRAVE website that asked for 24-word recovery phrases or Perfect Keys.

NGRAVE's investigation traced approximately $2.56 million stolen from 70 wallet addresses across four networks. Bitcoin accounted for $1.77 million, followed by $454,000 in XRP, $316,000 in Ethereum-based assets and $18,000 in Stellar. Bitquery, a blockchain analytics firm, traced approximately $2.65 million in suspected losses across 84 wallets and noted that other phishing attacks may have affected some of them.

The company said unauthorized access may have begun on Oct. 11, six days before the fake alerts. It detected the malicious alerts within a minute of their appearance at 9:30 p.m. UTC on Oct. 17, yet the first wallet was drained six minutes later. NGRAVE disabled its notification system by 10:45 p.m., but thefts from already compromised wallets continued until 3:51 a.m. the next morning.

NGRAVE said its ZERO hardware wallets and private keys were not breached. Attackers instead recreated wallets using credentials users entered on the fake site. The company's CEO said the firm had "absolutely and utterly failed" to provide security.

Why it matters

The incident shows that a hardware wallet's offline key storage does not protect users from a convincing message sent through a trusted channel. Attackers did not need to break the device, they needed users to type their recovery phrases into a lookalike page.

It follows a similar campaign against SecuX users on Oct. 16. Kraken chief security officer Nick Percoco described NGRAVE as the second wallet manufacturer in two days whose application notifications were used to steal recovery phrases.

Hardware wallet makers have faced several incidents this year. A Coldcard firmware flaw weakened the randomness used to generate recovery phrases, and TRM Labs estimated attackers stole about $116 million in Bitcoin. Ledger disclosed that criminals modified wallets distributed through resellers, with investigators linking the operation to thefts totaling more than $90 million.

What the data shows

Bitquery traced much of the stolen Bitcoin through 12 Chainflip swaps, while Ethereum and Solana proceeds passed through bridges before converging on 39 Hyperliquid accounts. Those accounts bought about 3,593 XMR1 tokens, which track the price of Monero, for $2.16 million. As of Bitquery's Oct. 19 check, the tokens had not been sold or withdrawn and were worth about $2.12 million.

Bitquery estimated that about 81% of the funds ended up on Hyperliquid. NGRAVE traced bitcoin into 12 addresses, while XRP moved through 54 transfers.

What is still unclear

• The two loss estimates differ: NGRAVE reported about $2.56 million from 70 wallets, while Bitquery estimated approximately $2.65 million across 84 wallets. Bitquery said other phishing attacks may have affected some of those wallets.
• NGRAVE said device information, wallet activity, IP addresses and approximate locations may have been exposed, raising the risk of follow-up targeted scams.

Questions readers ask