Belgian hardware-wallet maker Ngrave disclosed on Oct. 19 that attackers hijacked a third-party notification provider serving its LIQUID companion app, sending authentic-looking security warnings to customers on Oct. 17. The messages claimed a user’s portfolio had been synchronized with a Pixel 9 device in Moscow. Clicking the alert opened a counterfeit Ngrave website featuring a countdown timer and an ominous choice to approve or deny the suspicious activity.
Both options led to the same trap: users were prompted to enter their 24-word recovery phrase or Perfect Key, handing attackers everything needed to recreate their wallets. Automated scripts emptied compromised accounts within minutes. Ngrave’s investigation traced approximately $2.56 million stolen from 70 wallet addresses across four networks. Bitcoin accounted for $1.77 million, followed by $454,000 in XRP, $316,000 in Ethereum-based assets and $18,000 in Stellar.
Attackers Exploited Notification Keys, Not Hardware
The company’s incident report reveals that unauthorized access potentially began Oct. 11, six days before the fraudulent notifications appeared. Attackers obtained one access key and leveraged it to acquire another with broader permissions, including access to certain analytics information. Ngrave detected the malicious alerts within a minute of their appearance at 9:30 p.m. UTC on Oct. 17. Nevertheless, the first wallet was drained six minutes later.
The company disabled its notification system by 10:45 p.m., but thefts continued from previously compromised wallets until 3:51 a.m. the following morning. Crucially, Ngrave maintains its ZERO hardware wallets and private keys remained untouched. The criminals instead manipulated customers into surrendering their own credentials.
Ngrave CEO Admits Company ‘Absolutely and Utterly Failed’
The stolen funds traveled through exchanges, blockchain bridges, and fresh addresses. Ngrave traced bitcoin into 12 addresses, while XRP moved through 54 transfers. The company also acknowledged potential exposure of device information, wallet activity, IP addresses, and approximate locations, raising concerns about subsequent targeted scams.
The analytics firm Bitquery also published a report on the matter, noting that, in terms of the stolen funds, “most of it now sits on Hyperliquid as a Monero token.” The Bitquery report estimates around 81% found its way to the popular perps DEX exchange.
Ngrave’s CEO offered an unusually candid assessment, stating: “In my humble opinion, the first duty of a crypto security company is to provide exactly that: security. In this, we have absolutely and utterly failed.” He acknowledged that the company’s security posture was inadequate when he assumed leadership months earlier. Ngrave has since replaced compromised keys and outlined tighter notification controls, including two-person approvals, restricted domains and emergency shutdown capabilities.
Affected customers are being urged to establish fresh wallets and contact support. The investigation continues, leaving a troubling distinction intact: the hardware held firm, but the trusted messages surrounding it became the weapon.
It’s been a tough year for hardware wallet makers as 2026 has been riddled with security issues. Nearly a dozen documented hardware-wallet security incidents involving Ledger, Trezor, Tangem, Safepal, Bitbox02, and Coldcard. Reported losses exceeded $180 million across two incidents, exposing vulnerabilities in firmware, third-party vendors, physical security, and phishing, rather than direct remote attacks on recovery phrases.
