NGRAVE users lose $2.65 million in phishing attack exploiting app notifications

Attackers compromised third-party push notification service to steal recovery phrases from hardware wallet customers

By LineZotpaper

Published20 October 2026

Read Time2 min

A phishing attack targeting users of NGRAVE's LIQUID companion app resulted in approximately $2.65 million in losses across 84 cryptocurrency wallets on October 17, blockchain analytics firm Bitquery has reported. The attackers hijacked push notifications delivered through the app to trick users into handing over their recovery phrases, allowing them to recreate wallets and drain assets without accessing the physical hardware devices.

NGRAVE confirmed in an October 19 incident report that a third-party service responsible for LIQUID push notifications was compromised. The fraudulent messages warned users that their cryptocurrency portfolios had been synchronised with a Pixel 9 device in Moscow, and directed them to a phishing website that requested recovery phrases or NGRAVE Perfect Keys. With those credentials, the attackers recreated affected wallets and transferred assets.

Bitquery traced the stolen funds across multiple blockchains. Bitcoin suffered the largest share, with about $1.76 million drained from 21 wallets. The proceeds were moved through 12 Chainflip swaps and bridges from Ethereum and Solana before converging on 39 Hyperliquid accounts, where they were used to purchase approximately 3,593 XMR1 tokens, a token tracking the price of Monero. As of October 19, the tokens had not been sold or withdrawn, and their combined value stood at about $2.12 million.

The attack followed a similar phishing campaign against SecuX wallet users on October 16, raising concerns about attackers exploiting trusted communication channels. Nick Percoco, Kraken's chief security officer, noted that NGRAVE was the second wallet manufacturer in two days whose application notifications were used to steal recovery phrases.

The incidents cap a difficult year for hardware wallet security. In July, a firmware vulnerability affecting Coldcard devices weakened the randomness used to generate recovery phrases, allowing private key reconstruction. More recently, Ledger disclosed that criminals had modified hardware wallets distributed through resellers, installing hidden components designed to capture recovery phrases.

Analysis

Why This Matters

This attack shows that hardware wallets, which are marketed as the most secure way to store cryptocurrency, can still be compromised via the software ecosystem around them, such as mobile app notifications.
Users who relied on push alerts from their wallet provider may now face uncertainty about the legitimacy of future security messages.
The pattern of targeting notification systems represents a growing threat vector that could affect other hardware wallet manufacturers.

Background

Hardware wallets store private keys offline on a physical device, but they often rely on companion apps and third-party services for notifications and transactions. Recent months have seen multiple high-profile incidents targeting these auxiliary systems. The Coldcard firmware vulnerability in July and the Ledger tampering case, both mentioned in NGRAVE's incident report, highlight that security weaknesses can arise at multiple points in the supply chain and software stack.

Key Perspectives

Victims and NGRAVE users: Lost funds directly; may question the security assumptions of hardware wallets and the trustworthiness of app notifications. Hardware wallet manufacturers: Face increasing pressure to secure not only the devices themselves but also the third-party services and communication channels that support them. Critics and security researchers: The repeated breaches undermine the core value proposition of hardware wallets if users can still be easily phished through software side channels. Some argue that the industry has focused too heavily on device security while neglecting the ecosystem.

What to Watch

Whether law enforcement or exchange operators can freeze the XMR1 tokens held in Hyperliquid accounts.
Whether other hardware wallet makers will disclose similar notification-based attacks in the coming days.
Steps NGRAVE and other firms take to secure third-party notification services and improve user education against phishing.

Sources

Crypto wallet security crisis deepens as NGRAVE users face $2.65 million phishing attack · CryptoSlate

Checked

12 claims in this story checked against 1 source: 8 supported.

Show each claim

Partly supportedNGRAVE users lost $2.65 million in a phishing attack exploiting app notifications.CryptoSlate: “Blockchain analytics firm Bitquery traced approximately $2.65 million in suspected losses across 84 cryptocurrency wallets”
SupportedAttackers compromised a third-party push notification service to steal recovery phrases from hardware wallet customers.CryptoSlate: “NGRAVE confirmed that attackers compromised access to a third-party service responsible for delivering LIQUID push notifications. The fraudulent messages warned users that their cryptocurrency portfolios had been synchronized with a Pixel 9 device in Moscow. After the alerts, victims were directed to a website that asked for their recovery phrases or NGRAVE Perfect Keys.”
Partly supportedBitquery reported approximately $2.65 million in losses across 84 wallets from an October 17 attack.CryptoSlate: “Blockchain analytics firm Bitquery traced approximately $2.65 million in suspected losses across 84 cryptocurrency wallets following the Oct. 17 attack”
SupportedThe phishing messages tricked users into handing over recovery phrases, allowing attackers to recreate wallets and transfer assets without accessing the hardware devices.CryptoSlate: “Those credentials let attackers recreate affected wallets and transfer assets without accessing the ZERO hardware devices, which NGRAVE said kept private keys offline.”
SupportedNGRAVE confirmed in an October 19 incident report that a third-party service responsible for LIQUID push notifications was compromised.CryptoSlate: “In an Oct. 19 incident report , NGRAVE confirmed that attackers compromised access to a third-party service responsible for delivering LIQUID push notifications.”
SupportedFraudulent messages referred to a Pixel 9 device in Moscow and directed users to a website requesting recovery phrases or NGRAVE Perfect Keys.CryptoSlate: “The fraudulent messages warned users that their cryptocurrency portfolios had been synchronized with a Pixel 9 device in Moscow. After the alerts, victims were directed to a website that asked for their recovery phrases or NGRAVE Perfect Keys.”
SupportedBitcoin had the largest share of losses, with about $1.76 million drained from 21 wallets.CryptoSlate: “Bitcoin accounted for the largest share, with attackers draining about $1.76 million from 21 wallets”
Partly supportedFunds moved through 12 Chainflip swaps and bridges from Ethereum and Solana before converging on 39 Hyperliquid accounts.CryptoSlate: “Bitquery traced much of the stolen Bitcoin through 12 Chainflip swaps, while Ethereum and Solana proceeds passed through bridges before converging on 39 Hyperliquid accounts.”
SupportedThe Hyperliquid accounts purchased about 3,593 XMR1 tokens, worth about $2.12 million as of October 19, which had not been sold or withdrawn.CryptoSlate: “The accounts then purchased about 3,593 XMR1 tokens, a cryptocurrency that tracks the price of privacy-focused Monero , for $2.16 million. As of Bitquery's latest recorded check on Oct. 19, the tokens had neither been sold nor withdrawn. Their combined value was about $2.12 million”
SupportedA similar SecuX phishing campaign occurred on October 16, raising concerns about attacks using trusted communication channels.CryptoSlate: “The incident follows a similar phishing campaign against SecuX users on Oct. 16, raising concerns about attackers exploiting trusted communication channels to target hardware wallet customers.”
SupportedNick Percoco said NGRAVE was the second wallet manufacturer in two days whose application notifications were used to steal recovery phrases.CryptoSlate: “Nick Percoco, Kraken's chief security officer, highlighted the similarities between the two incidents, describing NGRAVE as the second wallet manufacturer in two days whose application notifications were used to steal recovery phrases.”
Partly supportedLedger disclosed that criminals modified reseller-distributed hardware wallets, installing hidden components designed to capture recovery phrases.CryptoSlate: “More recently, Ledger disclosed that criminals modified hardware wallets distributed through resellers, installing hidden components that could capture recovery phrases.”