Attackers compromised NGRAVE’s push notification service on October 17, sending phishing messages that directed users to fake websites harvesting recovery phrases, enabling wallet recreation and theft of an estimated $2.65 million in cryptocurrency across 84 wallets.
The NGRAVE LIQUID companion app delivered fraudulent notifications claiming cryptocurrency portfolios were synchronized with a Pixel 9 device in Moscow. Victims were directed to websites requesting recovery phrases or NGRAVE Perfect Keys. The attack lasted approximately 6 hours.
Bitcoin accounted for the largest portion of losses. Twenty-one Bitcoin wallets were drained, with $1.76 million in BTC stolen. Twelve Chainflip swaps were used to move the stolen Bitcoin. Ethereum and Solana proceeds passed through bridges before reaching Hyperliquid, where 39 accounts received $2.16 million in stolen funds.
Attackers also converted stolen assets to XMR1 tokens, a Monero price tracker. As of October 19, 3,593 XMR1 tokens valued at $2.12 million had not been sold or withdrawn, according to Bitquery’s blockchain analysis.
The theft spanned multiple blockchain assets including XRP, Dogecoin, and Stellar alongside Bitcoin and Ethereum.
NGRAVE stated that private keys remained offline on ZERO hardware devices, meaning the compromise did not extend to the physical wallet itself. The breach targeted the notification layer of the companion app, not the core security architecture of the hardware wallet.
Nick Percoco, Kraken’s chief security officer, described NGRAVE as the “second wallet manufacturer in two days whose application notifications were used to steal recovery phrases.” SecuX experienced a similar phishing campaign targeting its app notifications on October 16.
The NGRAVE incident follows other major hardware wallet security compromises. A Coldcard firmware vulnerability disclosed in July weakened recovery phrase randomness, allowing private key reconstruction and resulting in $116 million in Bitcoin theft. Ledger disclosed that criminals modified hardware wallets through resellers, installing hidden components to capture recovery phrases, linked to $90 million in cryptocurrency thefts.
NGRAVE published an incident report on October 19 detailing the attack. The company did not specify whether it has notified affected users or regulatory authorities, or disclose details about the third-party service that delivered the compromised notifications.
