A phishing attack exploiting NGRAVE's LIQUID companion app notifications resulted in approximately $2.65 million in suspected cryptocurrency losses across 84 wallets on October 17, according to blockchain analytics firm Bitquery.
Attackers compromised a third-party service delivering LIQUID push notifications, sending fraudulent alerts claiming users' cryptocurrency portfolios had been synchronized with a Pixel 9 device in Moscow. The messages directed victims to a website requesting their recovery phrases or NGRAVE Perfect Keys, credentials that allowed attackers to recreate wallets and transfer assets despite NGRAVE's hardware devices keeping private keys offline.
The theft unfolded over approximately six hours across multiple blockchains. Bitcoin accounted for the largest share, with attackers draining about $1.76 million from 21 wallets. Bitquery traced $2.16 million in suspected proceeds to 39 Hyperliquid accounts, where attackers purchased approximately 3,593 XMR1 tokens—a cryptocurrency tracking privacy-focused Monero—for $2.16 million. As of October 19, the tokens remained in identifiable accounts with a combined value of approximately $2.12 million.
The incident follows a similar attack against SecuX users on October 16, highlighting a pattern of attackers exploiting trusted communication channels to target hardware wallet customers. Kraken's chief security officer Nick Percoco noted NGRAVE was the second wallet manufacturer in two days whose application notifications were weaponized to steal recovery phrases.
Mounting Security Challenges for Hardware Wallets
The attacks reflect broader vulnerabilities across the hardware wallet industry. In July, a firmware vulnerability in Coldcard devices compromised the randomness of wallet recovery phrase generation, potentially exposing private keys. TRM Labs estimated attackers stole approximately $116 million in Bitcoin from the vulnerability.
More recently, Ledger disclosed that criminals modified hardware wallets distributed through resellers by installing hidden components capable of capturing recovery phrases, with investigators linking the operation to suspected cryptocurrency thefts exceeding $90 million.
The pattern of breaches has exposed weaknesses spanning software vulnerabilities, compromised distribution channels, and fraudulent messages delivered through legitimate applications. Hardware wallet manufacturers face increasing pressure to strengthen security beyond devices themselves, particularly across third-party services and customer-facing infrastructure.
