TL;DR: NGRAVE says attackers hijacked a notification provider used by LIQUID, directing users to a fake recovery-page and stealing at least $2.56 million.
A convincing security notification became the entry point for a costly crypto phishing campaign. Hardware wallet maker NGRAVE reports that a third-party provider used for sending alerts from the LIQUID app was compromised, enabling attackers to deliver a fraudulent warning to customers on October 17.
This deceptive notification led recipients to a website that closely mimicked NGRAVE’s official pages. Unsuspecting users who entered their recovery phrases or Perfect Keys inadvertently handed over the sensitive information necessary for the attackers to access their funds. In an incident report released on October 19, NGRAVE estimated that around $2.56 million was stolen from approximately 70 wallet addresses spanning four different networks.
The breakdown of the stolen assets revealed approximately $1.77 million in Bitcoin, $454,000 in XRP, $316,000 in Ethereum, and $18,000 in Stellar. NGRAVE emphasized that this figure represents a minimum estimate, as they continue to investigate the affected accounts.
Importantly, this event does not indicate a breach of the cryptographic security of the ZERO hardware device itself. Instead, the attacker took advantage of the trust placed in what appeared to be a legitimate software alert, ultimately coercing victims into revealing their secret credentials. In response, NGRAVE has disabled the compromised notification channel and replaced the relevant security keys. They reiterated the critical advice for all wallet holders: a legitimate security alert will never require you to enter your recovery phrase on a website.
Written by the News Desk and edited by Samuel Rae.
