Fake security alerts sent through NGRAVE's LIQUID app led to the theft of nearly $2.56 million in cryptocurrency, according to an incident report from the hardware wallet maker. The stolen funds were spread across 70 wallet addresses on four networks, with the first wallet emptied at around 21:36 UTC on the 17th and the last tracked theft occurring the next day.
How the attack worked
LIQUID is the mobile app that works alongside NGRAVE's ZERO hardware wallet. NGRAVE said attackers gained access tied to a third-party company that handles its app notifications. On the 17th, they used that access to push out fake security alerts.
The alert told users their portfolio had been synced with a new device, which would make most people assume someone else had gotten into their account. Anyone who tapped it landed on a copy of NGRAVE's site. It showed a countdown timer and an option to deny the sync. Choosing to deny led to a page asking for recovery credentials, so handing them over felt like part of locking the account down.
NGRAVE turned off notifications while it investigated the breach. LIQUID was back online once the problem was fixed.
Which assets were taken and where they went
Bitcoin was the biggest loss, followed by Ethereum. The stolen funds took different routes. Bitcoin was sent through Chainflip and mostly swapped for ETH. Solana was converted to USDC and bridged to other networks. Much of it passed through LI.FI and Mayan before ending up on Hyperliquid.
There, 39 newly created accounts used it to buy 3,592.71 XMR1, a token that tracks Monero's price. The spend was about $2.16 million in total.
Where the XRP, Stellar and Dogecoin went is still a mystery.
NGRAVE says at least $2.56 million was stolen.
