Belgian Hardware Wallet Firm Ngrave Confirms $2.56M Crypto Theft via Hijacked Push Notifications

TLDR

• Attackers compromised Ngrave’s third-party notification service and distributed fraudulent security warnings through the LIQUID app on October 17.
• Approximately $2.56 million in cryptocurrency was drained from 70 separate wallet addresses spanning four different blockchains.
• The largest portion of stolen assets was Bitcoin at $1.77 million, with additional losses in XRP, Ethereum-based tokens, and Stellar.
• Ngrave confirms its ZERO hardware devices remained secure; losses occurred when users voluntarily disclosed recovery phrases on a counterfeit website.
• The company’s chief executive acknowledged complete failure in security responsibilities and implemented enhanced protection measures.

A sophisticated phishing campaign resulted in approximately $2.56 million being stolen from customers of Belgian hardware wallet manufacturer Ngrave after cybercriminals took control of the company’s notification infrastructure. The breach was made public on October 19.

Cybercriminals exploited a weakness in a third-party service responsible for delivering push notifications to Ngrave’s LIQUID mobile application. They deployed fake security alerts on October 17 that appeared to originate from legitimate company channels.

The fraudulent notification claimed that a user’s cryptocurrency portfolio had been synchronized with a Pixel 9 smartphone located in Moscow, Russia. When recipients interacted with the alert, they were redirected to a convincing replica of Ngrave’s official website featuring an urgent countdown clock and options to authorize or reject the purported activity.

Regardless of which option users selected, both pathways led to the same malicious outcome. Victims were prompted to submit their complete 24-word recovery seed phrase or their Perfect Key backup—granting criminals unrestricted access to their digital assets.

Automated theft programs rapidly emptied compromised accounts in a matter of minutes. Ngrave’s forensic analysis identified 70 distinct wallet addresses across four blockchain networks that suffered losses.

Bitcoin comprised the majority of pilfered assets, totaling $1.77 million. Additional thefts included $454,000 worth of XRP, $316,000 in tokens built on Ethereum, and $18,000 in Stellar cryptocurrency.

Timeline of the Security Breach

According to Ngrave’s detailed incident analysis, unauthorized intrusion into their systems potentially began on October 11—a full six days prior to the distribution of fraudulent alerts. Intruders initially obtained a single access credential, which they subsequently leveraged to acquire a second key with elevated privileges, including partial access to analytics information.

The organization detected the malicious notifications within sixty seconds of their deployment at 9:30 p.m. UTC on October 17. Despite this rapid detection, the first victim’s wallet was completely emptied just six minutes after the initial alert.

Ngrave successfully disabled its entire notification infrastructure by 10:45 p.m. that evening. However, withdrawals from previously compromised wallets continued until 3:51 a.m. the following morning.

The company maintains that its ZERO hardware wallet devices and the private cryptographic keys they protect were never directly compromised. Rather, the attack relied on social engineering tactics to manipulate customers into voluntarily surrendering their own security credentials.

Stolen cryptocurrency was rapidly dispersed through various exchanges, cross-chain bridges, and newly created addresses in an effort to obscure the trail. Ngrave’s blockchain analysis tracked bitcoin movements into 12 separate addresses, while XRP was shuffled through 54 different transfers.

Blockchain analytics provider Bitquery published its independent assessment, stating that “most of it now sits on Hyperliquid as a Monero token.” Their research suggested approximately 81% of the stolen funds ultimately landed on the decentralized perpetual futures trading platform.

CEO Issues Public Apology

In an unusually candid admission included in the incident disclosure, Ngrave’s chief executive officer took personal responsibility for the security failure. “In my humble opinion, the first duty of a crypto security company is to provide exactly that: security. In this, we have absolutely and utterly failed,” he acknowledged.

He revealed that the organization’s security posture was inadequate when he assumed leadership several months prior to the incident. The company also confirmed that device metadata, wallet transaction patterns, IP addresses, and approximate geographic locations may have been accessed by the attackers.

This incident compounds a challenging period for the hardware wallet sector. Nearly twelve separate security breaches in 2026 have affected prominent manufacturers including Ledger, Trezor, Tangem, Safepal, Bitbox02, and Coldcard, with combined reported losses exceeding $180 million across just two incidents.

Ngrave has since rotated all compromised access keys and announced plans for substantially enhanced notification security protocols. New safeguards include mandatory dual-authorization for sensitive operations, domain restriction policies, and an emergency system shutdown capability.

The company is advising all affected users to generate new wallets immediately and reach out to customer support. The security investigation remains active and ongoing.