NGRAVE says fake wallet alert phishing attack stole at least $2.56 million

24 Oct 2026

24 Oct 2026, 06:12 UTC+02:00

A notification that looked official became the start of a costly phishing campaign. Hardware wallet maker NGRAVE says a third party provider it used to send alerts in its LIQUID app was compromised, letting attackers push a fake warning to customers on 17 October.

How the attack worked

The fake alert directed users to a website resembling NGRAVE’s own pages. People who entered their recovery phrase or Perfect Key there handed attackers what they needed to empty their wallets. In its 19 October incident report, NGRAVE said it had traced about $2.56 million taken from roughly 70 addresses across four networks.

The breakdown: about $1.77 million in bitcoin, $454,000 in XRP, $316,000 in Ethereum assets and $18,000 in Stellar. NGRAVE called the total a minimum while it keeps reviewing affected accounts.

The device was not broken

There is no evidence the ZERO hardware wallet’s cryptography was cracked. The attackers abused trust in a seemingly legitimate software alert and convinced victims to reveal their secrets. NGRAVE says it disabled the notification channel and replaced keys.

Supply chain attacks are rising

The incident fits a pattern this month. Fake Rabby and OKX Wallet browser extensions harvested seed phrases, the Railway cloud breach exposed developers’ private keys, and the PHP2Shell flaw put countless websites at risk. Attackers increasingly target the services around wallets rather than the wallets themselves.

What it means for traders

• The golden rule: a legitimate security alert will never ask you to type a recovery phrase into a website.
• Verify through a second channel: check the company’s official site or social accounts before acting on any warning.
• Keep only what you need on hot wallets and read our testing methodology on how we assess exchange security.

Sources

• Bitcoinist: NGRAVE Details $2.56 Million Phishing Attack That Used Fake Wallet Alerts

News is for information only and is not financial advice. More crypto news