Crypto thieves stole approximately $2.56 million from 70 wallet addresses after compromising a notification provider for Ngrave's LIQUID companion application. The Belgian hardware-wallet maker confirmed the breach on Oct. 19, confirming attackers never directly cracked its ZERO hardware devices.
The phishing operation began with fraudulent security warnings sent to customers on Oct. 17. These messages falsely claimed a user's portfolio had synchronized with a Pixel 9 device in Moscow. Clicking the alert directed users to a counterfeit Ngrave website featuring a countdown timer that demanded users either approve or deny the suspicious activity. Both options led to the same outcome: a prompt for users to enter their 24-word recovery phrase or Perfect Key.
Once users submitted their credentials, automated scripts emptied the compromised accounts within minutes. Ngrave's investigation traced the stolen funds across four distinct blockchain networks: Bitcoin accounted for $1.77 million, XRP $454,000, Ethereum-based assets $316,000, and Stellar $18,000.
Unauthorized access to the notification provider likely began on Oct. 11, six days before the fraudulent alerts appeared. Attackers initially gained one access key, then leveraged it to acquire another with broader permissions, including access to certain analytics information.
Ngrave detected the malicious notifications within one minute of their appearance at 9:30 p.m. UTC on Oct. 17. The first wallet was drained six minutes later. The company disabled its notification system by 10:45 p.m. UTC on Oct. 17, but thefts from previously compromised wallets continued until 3:51 a.m. the following morning.
The stolen funds moved through exchanges, blockchain bridges and fresh addresses. Ngrave tracked Bitcoin into 12 addresses and XRP through 54 separate transfers. Analytics firm Bitquery reported that approximately 81 percent of stolen funds moved onto Hyperliquid as a Monero token.
Ngrave acknowledged potential exposure of customer device information, wallet activity, IP addresses and approximate locations. In an incident report, CEO Ruben Merre said, "In my humble opinion, the first duty of a crypto security company is to provide exactly that: security. In this, we have absolutely and utterly failed."
