Belgian hardware wallet company Ngrave disclosed that attackers compromised a third-party service responsible for delivering push notifications in its LIQUID companion app. The breach allowed the criminals to send authentic-looking security alerts to customers on October 17, 2026.
The messages claimed that a user’s portfolio had been synchronized with a Pixel 9 device located in Moscow and urged immediate review.
Because the alerts traveled through the same official channel as legitimate Ngrave notifications, they appeared trustworthy.
Anyone who opened the alert was directed to a convincing counterfeit version of the Ngrave website.
The page displayed a countdown timer and presented an apparent choice to approve or deny the activity.
Both options led to the same request: users were asked to enter either their 24-word recovery phrase or their Perfect Key.
Once those credentials were supplied, automated scripts recreated the wallets and emptied the associated accounts within minutes.
Ngrave’s investigation has traced roughly $2.56 million stolen from about 70 wallet addresses across four blockchains, valued at October 17 prices.
Bitcoin accounted for approximately $1.77 million, XRP for about $454,000, Ethereum-related assets for roughly $316,000, and Stellar for $18,000.
The company emphasized that its ZERO hardware devices and the private keys stored on them were never breached.
Losses occurred solely because victims voluntarily provided recovery credentials on the phishing site.
Unauthorized access to the notification provider may have begun as early as October 11.
Attackers first obtained one access key and then used it to acquire a second key with broader permissions, including the ability to send messages and view certain analytics data.
Ngrave’s team detected the malicious alerts within about a minute of their appearance around 21:30 UTC on October 17.
The first wallet was nevertheless drained six minutes later.
The company cut off the initial key by 21:40 UTC, yet alerts continued through the second key until all notification sending was shut down at 22:45 UTC.
Thefts from already-compromised wallets persisted for several more hours, with the last traced drain occurring at 03:51 UTC on October 18.Stolen funds were rapidly moved through exchanges, bridges, and fresh addresses.
Bitcoin was split across multiple new addresses, XRP was deposited to an exchange in dozens of transfers, and Ethereum assets were bridged onward.
Ngrave is sharing attacker addresses and transaction details with law enforcement and has requested that exchanges and bridge operators freeze related balances.
In a candid statement, Ngrave’s CEO acknowledged that the company had “absolutely and utterly failed” its fundamental duty to provide security.
The firm has replaced the compromised keys and is implementing tighter controls, including dual approval for notifications, domain restrictions that prevent alerts from opening external sites, short-lived keys, and an emergency shutdown mechanism for the entire notification system.
Affected users who entered recovery information are advised to treat the original wallets as compromised on every network, move any remaining funds to newly generated wallets, and contact Ngrave support for a case number.
Those who merely opened the alert without entering credentials are considered safe, although the company warns of possible follow-on phishing attempts because limited device and activity data may have been exposed.
The episode underscores that even air-gapped hardware wallets remain vulnerable when the surrounding software channels and user trust can be manipulated. Ngrave continues to investigate and has pledged further updates as the tracing and response efforts progress.
