NGRAVE suffers phishing attack: approximately 70 wallets stolen, totaling 2.56 million USD

Digital hardware wallet manufacturer NGRAVE disclosed that attackers hijacked the third-party notification service used by its LIQUID companion app and sent false security alerts to users, resulting in approximately 70 wallet addresses being stolen across 4 blockchains, amounting to about 2.56 million dollars. Among these, the loss in Bitcoin was approximately 1.77 million dollars, XRP about 454,000 dollars, Ethereum assets about 316,000 dollars, and Stellar about 18,000 dollars.

The attackers induced users to click on a counterfeit website and enter their 24-word recovery phrase or Perfect Key, subsequently using automated scripts to transfer assets within minutes. NGRAVE stated that the ZERO hardware wallet and private keys were not directly compromised; the victims voluntarily provided their recovery credentials during the phishing process. Unauthorized access may have begun on October 11. After obtaining an access key, the attackers acquired a broader access key and sent false notifications on October 17; NGRAVE detected anomalies about 1 minute after the notifications appeared, but the first wallet was emptied 6 minutes later, and the notification system was shut down that evening.

NGRAVE's CEO stated that the company failed to fulfill the most basic security responsibilities of a cryptocurrency security firm and mentioned that affected keys have been replaced, with new dual approval, domain restrictions, and emergency shutdown mechanisms implemented. The company also reminded affected users to create new wallets and contact the support team, as some device information, wallet activity, IP addresses, and approximate locations may have been exposed.