Fake Ngrave Security Alerts Drain $2.56M From 70 Wallets

Published October 21, 2026, 10:25 AM PKT. Based on NGRAVE's incident disclosure of October 19 and its investigation report of October 21 (primary source), with additional reporting from Bitcoin.com, KuCoin, PANews and Bitquery (secondary sources).

Belgian hardware wallet maker NGRAVE said attackers hijacked a third party push notification provider serving its LIQUID companion app and used it to send fake security alerts to customers on October 17, 2026. The alerts claimed a user's portfolio had been synchronized with a Pixel 9 device in Moscow. Users who clicked through landed on a counterfeit NGRAVE website carrying a countdown timer and a choice to approve or deny the supposed activity. Both choices led to the same trap: a prompt to enter a 24 word recovery phrase or a Perfect Key, the credentials that recreate a wallet. Automated scripts emptied compromised accounts within minutes.

The Moscow Pixel 9 alert

NGRAVE's investigation traced approximately $2.56 million stolen from 70 wallet addresses across four blockchains. Bitcoin accounted for $1.77 million of the losses, followed by $454,000 in XRP, $316,000 in Ethereum based assets and $18,000 in Stellar. The company detected the malicious alerts within a minute of their appearance at 9:30 p.m. UTC on October 17. The first wallet was drained six minutes later.

The company disabled its notification system by 10:45 p.m. that night, but thefts from wallets that were already compromised continued until 3:51 a.m. the following morning. NGRAVE stressed that its ZERO hardware wallets and private keys were never touched. The criminals instead manipulated customers into surrendering their own credentials, which is why the hardware itself held while the money still left.

One leaked key became two

The company's incident report traces the intrusion back to October 11, six days before the fake alerts appeared. According to PANews' account of the report, the first notification service key leaked through an error message from a server that sends notifications. NGRAVE spotted the anomaly on October 11 and disabled the key within minutes, but the attacker had already used it to obtain a second key with broader permissions, including access to certain analytics information.

That second key is what made the October 17 attack possible. With it, the attacker could push messages through a channel users trusted, because the alerts arrived through NGRAVE's own notification system rather than through email or a random link. The gap between detection and damage was minutes, not hours, and the shutdown at 10:45 p.m. could not undo credentials that users had already typed into the counterfeit site.

Where the stolen coins went

NGRAVE traced the stolen Bitcoin into 12 addresses, while the XRP moved through 54 transfers. The analytics firm Bitquery reported that most of the haul, around 81%, now sits on Hyperliquid as a Monero token, a route that mixes the funds into a privacy focused asset on a popular perpetuals exchange. NGRAVE said it is tracking the flow of stolen funds and communicating directly with affected users.

The company also acknowledged that device information, wallet activity, IP addresses and approximate locations may have been exposed, raising the risk of follow up targeted scams against the same users. The investigation is continuing, and NGRAVE has not said whether any of the stolen funds have been recovered.

Absolutely and utterly failed

The company's chief executive offered an unusually candid assessment in the incident report, saying: "In my humble opinion, the first duty of a crypto security company is to provide exactly that: security. In this, we have absolutely and utterly failed." He acknowledged that the company's security posture was inadequate when he assumed leadership months earlier.

The admission matters because it draws a line NGRAVE itself insists on. The ZERO hardware wallet was not compromised, and the LIQUID app code was not leaked, according to the company. Users who did not enter their recovery phrase or Perfect Key on the phishing website are not at risk of losing funds. The failure was in the trusted messages around the hardware, not in the hardware, and that distinction is now the core of the company's repair plan.

What NGRAVE changed, and what users should do

NGRAVE said it has replaced the compromised keys and tightened notification controls, including two person approvals, restricted domains and emergency shutdown capabilities. The company will also restrict LIQUID to opening links only to official NGRAVE resources, and add alerts for abnormal key usage plus a short lived key mechanism so a single leaked key is useful for less time.

Affected customers are being urged to create fresh wallets and contact support. Users whose recovery phrases were compromised should move any remaining assets to a new wallet as soon as possible, since a phrase entered once gives an attacker permanent access to that wallet. The incident fits a wider pattern in 2026: Bitcoin.com counts nearly a dozen documented hardware wallet security incidents this year involving Ledger, Trezor, Tangem, SafePal, BitBox02 and Coldcard, with reported losses above $180 million across two incidents, exposing weaknesses in firmware, third party vendors, physical security and phishing rather than direct remote attacks on recovery phrases.

This article is news reporting and is not investment advice.

Sources

• NGRAVE, Incident disclosure and investigation report on the LIQUID false security alert incident (October 19 and October 21, 2026), primary source
• Bitcoin.com, Crypto Thieves Hijack Ngrave Alerts and Walk Away With $2.56M (October 20, 2026), secondary source
• KuCoin News, NGRAVE phishing attack steals $2.56 million from 70 wallets (October 2026), secondary source
• PANews, NGRAVE Releases Report on LIQUID False Security Alert Incident: Push Service Provider Access Was Hijacked (October 21, 2026), secondary source