NGRAVE Phishing Attack Linked to $2.65 Million in Losses

Hackers hijacked notifications from NGRAVE’s LIQUID companion app on Oct. 17, directing users to a phishing website that requested wallet recovery credentials. The attack led to an estimated $2.65 million in cryptocurrency losses across 84 wallets, according to blockchain analytics firm Bitquery.

The thefts took place over about six hours and involved Bitcoin, XRP, Ethereum, Solana, Dogecoin and Stellar. Bitcoin accounted for about $1.76 million of the losses, drained from 21 wallets.

The fraudulent notifications warned users that their cryptocurrency portfolios had been synchronized with a Pixel 9 device in Moscow. Recipients were directed to a website that requested recovery phrases or NGRAVE Perfect Keys. The credentials allowed the attackers to recreate wallets and transfer funds without accessing NGRAVE’s ZERO hardware devices. NGRAVE reported that private keys remained offline on the devices.

Bitquery traced about $2.16 million in suspected proceeds to 39 Hyperliquid accounts. The Bitcoin passed through 12 Chainflip swaps, while Ethereum and Solana assets moved through blockchain bridges before reaching the accounts.

The funds were used to buy about 3,593 XMR1 tokens, which track the price of privacy-focused cryptocurrency Monero. The tokens had not been sold or withdrawn as of Bitquery’s latest check on Oct. 19. Their combined value was about $2.12 million at that time.

Bitquery identified suspected victims through transaction patterns and reported losses. The firm noted that some of the 84 wallets may have been affected by other phishing attacks.

In an Oct. 19 incident report, NGRAVE reported that attackers had compromised a third-party service used to deliver LIQUID push notifications. Kraken Chief Security Officer Nick Percoco identified similarities between the attack and a phishing campaign targeting SecuX users on Oct. 16. He described NGRAVE as the second wallet manufacturer in two days whose application notifications had been used to obtain recovery phrases.

The incident follows other attacks involving hardware wallet companies. In July, a firmware vulnerability affecting Coldcard devices weakened the randomness used to generate recovery phrases. Blockchain intelligence firm TRM Labs estimated that attackers stole about $116 million in Bitcoin linked to the flaw.

Ledger disclosed that criminals had modified hardware wallets sold through resellers by installing hidden components capable of capturing recovery phrases. Investigators linked that operation to suspected cryptocurrency thefts exceeding $90 million.

The incidents involved firmware, reseller distribution channels and third-party services used to communicate with wallet users.