NGRAVE LIQUID Phishing Attack: What Happened and Is Your Wallet Safe?

NGRAVE LIQUID Phishing Attack: What Happened and Is Your Wallet Safe?

Custom Image
A phishing attack targeting NGRAVE’s LIQUID companion app has been linked to approximately $2.65 million in cryptocurrency losses across 84 wallets, according to blockchain analytics firm Bitquery. The incident began on October 17, 2026, when attackers exploited a third-party push-notification service to distribute fraudulent security alerts that appeared to come from the wallet application. Victims who followed the alerts were directed to a counterfeit website requesting their recovery phrases or NGRAVE Perfect Keys, allowing attackers to recreate wallets and transfer assets without physically accessing the original hardware devices.
 
The incident highlights a critical distinction in cryptocurrency security: a hardware wallet can protect private keys from many online threats, but it cannot prevent losses if users disclose the credentials needed to recover their wallets. NGRAVE has stated that its ZERO hardware wallet and the private keys stored on the device were not directly compromised. Nevertheless, the attack raises broader questions about third-party service security, trusted application notifications, and the responsibilities of self-custody providers. Understanding how the attack unfolded, where the stolen funds went, and which users may remain at risk is essential for anyone managing digital assets.

Key Takeaways

  • Estimated losses reached $2.65 million: Bitquery traced cryptocurrency transfers from 84 wallets across six blockchain networks. NGRAVE separately reported approximately $2.56 million in losses across around 70 wallet addresses on four networks. The estimates reflect different investigation scopes, and not every address in Bitquery’s analysis can be conclusively attributed to an NGRAVE customer.
  • The attack exploited a trusted communication channel: Attackers compromised access associated with a third-party service responsible for LIQUID push notifications and used it to deliver fraudulent security warnings.
  • Recovery credentials were the critical target: Victims were persuaded to enter their recovery phrases or NGRAVE Perfect Keys on a counterfeit website, allowing attackers to restore wallets elsewhere and transfer funds.
  • Most traced funds were converted into XMR1: Bitquery reported that approximately $2.16 million was used to purchase 3,592.71 XMR1 tokens across 39 new Hyperliquid accounts. This represented the observed position as of October 19, not a confirmed current balance.
  • Users should respond according to their exposure: Those who only clicked a link face a different risk from people who submitted recovery credentials. Anyone who disclosed a recovery phrase should treat the corresponding wallet as compromised.

What Happened in the NGRAVE LIQUID Phishing Attack?

The attack exploited the trust users placed in notifications from LIQUID, the mobile companion application for NGRAVE’s ZERO hardware wallet. According to NGRAVE’s official incident report, published on October 19, attackers hijacked access associated with a third-party notification provider and sent fraudulent security alerts on October 17. The messages warned recipients that their cryptocurrency portfolios had been synchronized with a new device, creating the impression that an unauthorized person had accessed their accounts.
 
The alerts directed users to a counterfeit website designed to resemble NGRAVE’s official interface. The page presented a security confirmation screen with a countdown and an option to deny the supposed synchronization. Following that option led users to another page requesting their recovery credentials. This sequence made the request appear to be a necessary security procedure rather than an attempt to steal wallet access.
 
The first publicly identified wallet drain occurred at approximately 21:36 UTC on October 17, according to Bitquery. The thefts continued into October 18, with the last transaction in its tracked sequence occurring shortly before 04:00 UTC. NGRAVE reported that it disabled the affected notification functionality and subsequently restored the LIQUID service after taking corrective action. The incident demonstrates how attackers can exploit a legitimate communication channel without needing to break the underlying wallet’s cryptographic protections.

How the Phishing Mechanism Worked

The attack followed a familiar social-engineering pattern, but the apparent legitimacy of the notification made it particularly concerning.
 
First, the fraudulent message created urgency by suggesting that a new device had accessed the user’s portfolio. Second, the counterfeit website presented an apparently legitimate security workflow. Finally, the recovery-credential request provided attackers with the information needed to reconstruct affected wallets.
 
The decisive step was not simply opening the notification. It was disclosing credentials that could be used to recover the wallet. According to Bitquery’s investigation, NGRAVE indicated that users who only clicked the link and neither entered information nor downloaded anything were safe from the specific credential-theft mechanism described in the incident. Users who submitted recovery credentials, however, faced a substantially more serious risk.

How Much Was Stolen and Where Did the Funds Go?

Bitquery estimated that approximately $2.65 million was taken from 84 wallets across Bitcoin, XRP, Ethereum, Solana, Dogecoin, and Stellar. NGRAVE’s own investigation identified approximately $2.56 million in losses involving around 70 wallet addresses across four networks and described its figure as a minimum. These estimates should remain separate because the investigations covered different sets of addresses and assets. Bitquery also acknowledged that blockchain transaction records alone cannot establish that every tracked wallet belonged to an NGRAVE customer.
 
Bitcoin accounted for the largest share of the losses, followed by XRP and Ethereum-related assets. The following figures are based on Bitquery’s on-chain analysis, with values rounded for readability.
Blockchain Estimated losses Share of total
Bitcoin (BTC) $1.76 million 66.40%
XRP $453,000 17.10%
Ethereum and related tokens $315,000 11.90%
Solana (SOL) $77,000 2.90%
Dogecoin (DOGE) $21,000 0.80%
Stellar (XLM) $19,000 0.70%
Total Approximately $2.65 million 100%

How the Stolen Cryptocurrency Was Moved

The on-chain trail suggests that the attacker used different routes depending on the asset involved. Bitcoin was transferred through Chainflip, a cross-chain swapping service, and converted primarily into Ether. Ethereum assets were consolidated and transferred through additional wallets. Solana funds were exchanged for USDC and moved across networks using bridging services.
 
Bitquery traced portions of these funds through services including LI.FI and Mayan before they reached Hyperliquid. The funds were divided among 39 newly created accounts, which purchased XMR1, a token designed to track Monero’s price and available for withdrawal as the underlying cryptocurrency under the relevant platform’s mechanisms.
 
According to Bitquery, the accounts purchased a combined 3,592.71 XMR1 for approximately $2.16 million. At 09:00 UTC on October 19, the holdings were valued at roughly $2.12 million, and Bitquery reported that the tracked tokens had not been sold or withdrawn at that time. These observations are time-specific: subsequent transactions could change the balances and make further tracing more difficult. Bitquery was also unable to establish the final destination of all XRP, Dogecoin, and Stellar funds.

Was NGRAVE ZERO Hacked?

The distinction between the compromised notification service and the hardware wallet itself is central to understanding the incident. NGRAVE stated that the attack did not directly compromise the ZERO device or the private keys stored on it. Instead, attackers used a third-party service associated with LIQUID notifications to reach users and persuade them to reveal their recovery credentials.
 
NGRAVE ZERO is designed to keep private keys offline, while LIQUID allows users to view portfolio information and manage supported transactions. According to NGRAVE’s LIQUID product documentation, the application does not have access to the private keys stored on ZERO. The two products communicate through QR codes as part of the intended transaction workflow. These protections can reduce exposure to remote attacks, but they cannot prevent an attacker from restoring a wallet elsewhere after obtaining the recovery information.
 
A recovery phrase, or the corresponding Perfect Key in NGRAVE’s terminology, provides the information needed to reconstruct wallet access. Once that information is disclosed, an attacker may be able to access supported blockchain addresses and transfer assets without possessing the original hardware device. This is why the absence of a confirmed hardware vulnerability does not make the losses any less serious.

What the Incident Reveals About Hardware Wallet Security

The attack illustrates that hardware-wallet security extends beyond the physical device. The surrounding ecosystem includes companion applications, notification providers, account-management systems, software updates, and customer-support processes. A weakness in one of these components can create an opportunity to attack users even when the core key-storage mechanism remains intact.
 
It is therefore important to distinguish between a cryptographic compromise and a social-engineering attack. The available evidence supports the latter explanation for this incident. It does not establish that the ZERO device’s security architecture was broken, although the broader incident raises legitimate questions about third-party access controls and how security-sensitive notifications should be authenticated.

How NGRAVE Responded to the Incident

NGRAVE reported that it detected the fraudulent notification activity, revoked affected access, and disabled notification sending while investigating the incident. Its published response described the compromise of a third-party provider’s access as the entry point. The company subsequently restored LIQUID after taking corrective action and outlined measures intended to strengthen the notification system.
 
The announced changes included tighter restrictions on notification links, additional approval requirements for sending notifications, and improvements to access-key management and emergency shutdown procedures. These measures address several of the weaknesses exposed by the attack: excessive third-party permissions, insufficient separation of responsibilities, and the potential for a compromised notification channel to reach users at scale.
 
NGRAVE also reported that attackers accessed certain information associated with the notification system. The information potentially exposed included device details, country and time-zone information, usage data, and IP addresses. The precise scope of any personal-data exposure should be distinguished from the confirmed cryptocurrency losses, and users should rely on subsequent official disclosures for updates about the investigation and remediation.
 
The response also raises a broader industry question: should a wallet application be able to send a security notification that directs users to a page requesting recovery credentials? Stronger controls can reduce the risk of a compromised notification service, but security messaging should also make clear that recovery phrases and private keys must never be entered into websites or submitted to support staff.

Is Your NGRAVE Wallet Safe? What Users Should Do

The appropriate response depends on what a user did after receiving a suspicious notification. Merely receiving a message does not mean that a wallet has been compromised, and clicking a link is not equivalent to disclosing recovery credentials. However, users should not assume that a wallet remains safe simply because the original hardware device is still in their possession.
User situation Risk assessment Recommended action
Received the notification but did not open it No credential exposure from the notification itself Ignore the message and verify announcements through independently accessed official channels.
Opened the link but entered no information and downloaded nothing Lower risk from the specific phishing method described Close the page and avoid further interaction. Check for any downloads, installations, or permissions granted.
Entered a recovery phrase or Perfect Key Treat the corresponding wallet as compromised Create a new wallet with new recovery credentials using a trusted process, then transfer remaining assets as soon as safely possible.
Found unauthorized transactions or missing assets Assets may already have been transferred beyond direct recovery Preserve transaction hashes, wallet addresses, timestamps, screenshots, and suspicious URLs; contact official support and relevant exchanges or law-enforcement authorities.

What to Do if You Entered Your Recovery Phrase

If you submitted your recovery phrase or Perfect Key to the fraudulent website, treat every wallet that can be reconstructed from those credentials as potentially compromised. Do not continue using the exposed credentials, and do not assume that moving the original hardware device to a different location will restore security.
 
Using a trusted device and a verified recovery procedure, create a new wallet with entirely new recovery credentials. Transfer any remaining assets from the compromised wallet to the new wallet, checking each destination address carefully. If the original credentials protect assets across multiple networks, review every supported network rather than checking only the wallet where the first suspicious transaction appeared.
 
Users should also be alert to follow-up scams. Attackers may impersonate customer-support representatives, promise to recover stolen assets, or request additional credentials and fees. Recovery phrases and private keys should never be shared with a support agent or entered into a website merely because a message claims that the action is necessary to secure funds.
 
Anyone who has lost assets should preserve transaction evidence and report the incident promptly. Cryptocurrency transfers are generally difficult to reverse once confirmed, but timely documentation and reporting may assist investigations or help platforms identify suspicious funds.

What the Attack Means for Hardware Wallet Security

The NGRAVE incident highlights three wider lessons for the cryptocurrency industry. First, third-party service providers can become a security weakness even when the core product is designed to keep sensitive credentials offline. Wallet manufacturers need to apply strict access controls, minimize third-party privileges, rotate credentials when appropriate, monitor unusual activity, and maintain an effective way to disable compromised services.
 
Second, trusted notifications should not replace independent verification. Users are accustomed to treating messages from installed applications as more credible than unsolicited emails or social-media posts. This attack exploited precisely that assumption. Wallet providers should design security alerts so that users can verify them independently and should never normalize requests to enter recovery phrases into a web form.
 
Third, self-custody requires more than buying a hardware device. It also depends on recovery-credential protection, transaction verification, safe device practices, and an understanding of what a legitimate recovery process should look like. Hardware wallets can reduce certain technical risks, but no product can fully protect a user who voluntarily discloses the credentials that control their assets.
 
For wallet manufacturers, the incident reinforces the need to treat the entire user experience as part of the security boundary. For users, the most important principle remains straightforward: recovery credentials should stay private and offline, and any unexpected request to disclose them should be treated as a serious warning sign.

Conclusion

The NGRAVE LIQUID phishing attack demonstrates that hardware-wallet security depends on more than keeping private keys offline. Attackers reportedly exploited a third-party notification service, used fraudulent security alerts to gain users’ trust, and obtained recovery credentials that enabled them to transfer cryptocurrency without directly accessing the original hardware devices. Bitquery estimated the tracked losses at approximately $2.65 million, while NGRAVE reported a separate minimum estimate of around $2.56 million. Both figures underscore the financial consequences of a compromised communication channel and successful social engineering.
 
For users, the immediate priority is to determine whether recovery credentials were disclosed and act accordingly. For wallet providers, the incident reinforces the importance of strict third-party access controls, independently verifiable security notifications, and clear warnings against sharing recovery information. A hardware wallet remains an important self-custody tool, but its protection depends on users keeping the credentials that restore access to their assets private.

🔥 Beyond the Headlines: What KuCoin 5.0 Means for You

Market news moves fast — but where you act on it matters just as much. This October, KuCoin launches KuCoin 5.0, transforming KuCoin into a rebuilt platform. Here's what actually changes for you:
 
  • One account for everything. Older platforms split your money across separate "spot," "margin," and "futures" accounts and expected you to understand why. KuCoin 5.0's unified account removes that entirely — deposit once, and everything is simply there (only available to VIPs for now).
  • Stocks, indices, and commodities. KuCoin 5.0 expands beyond crypto into global markets. When crypto chops sideways and equities rally (or the reverse), you rotate in minutes instead of opening a brokerage account and waiting days for fiat rails.
  • Real-world assets (RWA). Tokenized exposure to traditional assets like commodities, right inside your crypto account. One of the fastest-growing segments in global finance is no longer reserved for institutions — you access it from the same balance you trade with.
  • Earn while you learn. Not ready to trade? KCUSD lets your stablecoins earn daily, auto-compounding interest. The lowest-stress way to put your idle deposit to work for 4% yield.
  • An AI assistant in plain language. Ask questions, get market context, understand what you're looking at — built into the platform, no jargon required.
  • An app that doesn't overwhelm. Faster, cleaner, and consistent — intuitive from the first tap, not after a tutorial.
  • Safety you can check, not just trust. A MiCAR-licensed EU entity, Proof of Reserves you can verify yourself, and internationally certified security (SOC 2 Type II, ISO 27001:2022).
 
Create your account in minutes — and start on the platform built for where crypto is going, not where it's been.

FAQs

Was NGRAVE hacked?

NGRAVE reported that attackers compromised access associated with a third-party provider responsible for LIQUID push notifications. The available evidence points to a phishing attack that stole users’ recovery credentials rather than a confirmed breach of the ZERO hardware wallet’s private-key storage mechanism.

How much was stolen in the NGRAVE phishing attack?

Bitquery estimated approximately $2.65 million was taken from 84 wallets across six blockchain networks. NGRAVE separately traced approximately $2.56 million across around 70 addresses on four networks. The figures differ because the investigations covered different sets of addresses and assets.

Is NGRAVE ZERO still safe to use?

The incident does not establish that the ZERO hardware wallet itself was compromised. However, users should follow NGRAVE’s official security updates, avoid suspicious links, and treat any recovery credentials entered into the phishing website as compromised. The security of the device does not restore the secrecy of credentials that have already been disclosed.

What should I do if I only clicked the phishing link?

NGRAVE indicated that users who only clicked the link and neither entered information nor downloaded anything were safe from the specific credential-theft mechanism described. Close the page, avoid further interaction, and check whether anything was downloaded or any permissions were granted. If you entered recovery information, take the more urgent steps described above.

Can stolen cryptocurrency be recovered?

Recovery is uncertain. Confirmed blockchain transactions generally cannot be reversed by the sender, and tracing funds does not guarantee that they can be returned. Preserving transaction evidence and promptly reporting the incident may help investigators or relevant platforms identify and potentially restrict funds where their systems and applicable procedures permit.
 
Disclaimer: This article is for informational purposes only and does not constitute investment or financial advice. Cryptocurrency transactions carry risks, and stolen assets may not be recoverable.