Ngrave LIQUID Notification Phishing

On October 17, 2026, Ngrave, a Belgian hardware-wallet maker, saw roughly 70 of its customers' wallets emptied for approximately $2.56 million after attackers hijacked the third-party push-notification provider behind its LIQUID companion app and used it to blast fake security alerts that funnelled victims into a credential-phishing page.

What happened

The weakness was not in Ngrave's ZERO hardware devices, which the company said were never directly broken, nor in the private keys themselves — it was in the notification channel customers were conditioned to trust. Ngrave said attackers first obtained one access key for the notification system, then used it to escalate to another key with broader permissions, including access to some analytics data. Unauthorised access may have begun around October 11, six days before the attack went loud.

At roughly 21:30 UTC on October 17, the attackers pushed fraudulent alerts through the legitimate pipeline. One message warned that the user's portfolio had synced with a Pixel 9 device in Moscow; tapping it opened a counterfeit Ngrave site with a countdown timer and approve/deny buttons that pressured victims into entering their 24-word recovery phrase or Perfect Key. Automated scripts then swept the wallets within minutes. Ngrave said it detected the malicious alerts within about a minute, the first wallet was drained six minutes later, and the notification system was disabled by 22:45 UTC — but thefts from already-compromised wallets continued until 03:51 UTC the next morning. Losses broke down to roughly $1.77M in Bitcoin, $454K in XRP, $316K in Ethereum-based assets, and $18K in Stellar.

Aftermath

Stolen funds moved through exchanges, cross-chain bridges, and fresh addresses; Ngrave traced the Bitcoin into 12 addresses and the XRP across 54 transfers, and on-chain analytics firm Bitquery estimated about 81% of the proceeds reached the perpetuals DEX Hyperliquid. No funds had been recovered as of disclosure, and the investigation remained open. Ngrave replaced the compromised keys and tightened its notification controls with two-person approvals, restricted domains, and an emergency shutdown capability, while its CEO publicly admitted the company "absolutely and utterly failed" at its core security duty. Affected customers were told to treat their wallets as compromised and move assets to freshly generated ones. Notably, Kraken's security chief flagged Ngrave as the second wallet manufacturer in two days whose in-app notifications were abused to steal recovery phrases, after a similar fake-alert campaign hit SecuX on October 16.

Why it matters

The Ngrave breach shows that a hardware wallet's cryptographic security is only as strong as the communication channels wrapped around it. By compromising a trusted notification pipeline rather than the device, the attackers borrowed Ngrave's own credibility to deliver a phishing lure that users had little reason to doubt — the same playbook that drained users of other wallet brands such as the Ledger reseller supply-chain attack and the D'CENT companion-app compromise. The unbreakable rule holds regardless of hardware: a recovery phrase typed into any website or app is already gone, because a legitimate wallet provider never needs it. The incident also underscores how vendor and third-party infrastructure — push-notification services, analytics backends, in-app banners — form an under-examined attack surface whose compromise can be weaponised against the very users a secure device was meant to protect.