Community Trust ScoreVerified
Hardware wallet manufacturer NGRAVE disclosed on October 19 that attackers stole at least $2.56 million from approximately 70 wallet addresses by hijacking a third-party notification provider used by its LIQUID application. The incident, which began on October 17, involved a phishing campaign that exploited a compromised alert system to direct users to a fraudulent recovery page.
Attack Mechanism and Financial Impact
According to the company’s incident report, the attack vector was a security notification sent through a third-party provider responsible for LIQUID app alerts. Attackers compromised this provider, allowing them to push a fake warning to customers. The notification directed recipients to a website that closely resembled NGRAVE’s official pages. Individuals who entered their recovery phrase or Perfect Key into this site inadvertently provided the credentials necessary for the attackers to access and transfer their funds.
NGRAVE traced the stolen assets to four different blockchain networks. The total value of the theft was reported as a minimum of $2.56 million, a figure the company stated is subject to revision as it continues to examine affected accounts. The breakdown of the stolen funds includes roughly $1.77 million in Bitcoin, $454,000 in XRP, $316,000 in Ethereum assets, and $18,000 in Stellar.
Security Response and Device Integrity
The incident did not involve a breach of the cryptographic security of NGRAVE’s ZERO hardware device. The company emphasized that the attack relied on social engineering, exploiting user trust in what appeared to be a legitimate software alert. By persuading victims to reveal their private secrets, the attackers bypassed the hardware device’s physical security features.
In response to the compromise, NGRAVE disabled the affected notification channel and replaced the relevant keys. The company reiterated its standard security guidance for wallet holders: a legitimate security alert from NGRAVE will never require users to type their recovery phrase into a website. The firm is currently continuing its review of all potentially affected accounts to determine the full scope of the incident.
Frequently Asked Questions
How much money was stolen in the NGRAVE phishing attack?
NGRAVE reported a minimum of $2.56 million stolen from approximately 70 wallet addresses. The funds were distributed across Bitcoin, XRP, Ethereum assets, and Stellar.
Did the attack compromise the NGRAVE ZERO hardware device?
No, the attack did not crack the cryptography of the ZERO hardware device. The theft occurred because users entered their recovery phrases into a fake website after receiving a compromised notification.
