TLDR Hackers hijacked a third-party notification provider for Ngrave’s LIQUID app and sent fake security alerts on Oct. 17. About $2.56 million was stolen from 70 wallet addresses across four
Belgian hardware wallet maker Ngrave says thieves stole about $2.56 million from its customers after hijacking a system used to send app alerts. The company disclosed the attack on Oct. 19.
Attackers gained control of a third-party notification provider used by Ngrave’s LIQUID companion app. On Oct. 17, they used it to send fake security warnings straight to users.
The message said a user’s portfolio had been synced with a Pixel 9 device in Moscow. Tapping the alert opened a fake Ngrave website with a countdown timer and buttons to approve or deny the activity.
Both buttons led to the same trap. Users were asked to enter their 24-word recovery phrase or their Perfect Key, which gave attackers full access to their wallets.
Automated scripts then emptied the accounts within minutes. Ngrave traced the losses to 70 wallet addresses across four networks.
Bitcoin made up most of the stolen funds at $1.77 million. Thieves also took $454,000 in XRP, $316,000 in Ethereum-based assets and $18,000 in Stellar.
Ngrave’s incident report says unauthorized access may have started on Oct. 11, six days before the fake alerts went out. Attackers got one access key and used it to obtain a second key with wider permissions, including access to some analytics data.
The company spotted the fake alerts within a minute of their appearance at 9:30 p.m. UTC on Oct. 17. Even so, the first wallet was drained six minutes later.
Ngrave shut off its notification system by 10:45 p.m. Thefts from wallets that were already compromised continued until 3:51 a.m. the next morning.
The company says its ZERO hardware wallets and private keys were never breached. Instead, attackers tricked customers into handing over their own recovery details.
The stolen funds moved through exchanges, blockchain bridges and new addresses. Ngrave traced bitcoin into 12 addresses, while XRP moved through 54 transfers.
Analytics firm Bitquery said in its own report that “most of it now sits on Hyperliquid as a Monero token.” It estimated about 81% of the funds ended up on the decentralized perpetuals exchange.
Ngrave’s CEO gave a direct statement in the incident report. “In my humble opinion, the first duty of a crypto security company is to provide exactly that: security. In this, we have absolutely and utterly failed,” he said.
He said the company’s security was not strong enough when he took over as leader months earlier. Ngrave also said device information, wallet activity, IP addresses and approximate locations may have been exposed.
The incident adds to a difficult year for hardware wallet makers. Nearly a dozen security incidents in 2026 have involved brands such as Ledger, Trezor, Tangem, Safepal, Bitbox02 and Coldcard, with reported losses topping $180 million across two incidents.
Ngrave has replaced the compromised keys and plans tighter notification controls. These include two-person approvals, restricted domains and an emergency shutdown option.
The company is urging affected customers to set up new wallets and contact support. Its investigation is ongoing.
The post Ngrave Wallet Users Lose $2.56M in Bitcoin and XRP After Fake Security Alerts appeared first on Blockonomi.
