Crypto Thieves Hijack Ngrave Notifications to Steal $2.56 Million
Attackers exploited a third-party notification provider to phish recovery phrases from hardware wallet users.
1Notification System Hijack
On October 17, 2026, attackers compromised a third-party notification provider used by Ngrave’s LIQUID app. By sending authentic-looking alerts about unauthorized device synchronization, criminals directed users to a counterfeit website. This breach bypassed hardware security by manipulating users into voluntarily surrendering their 24-word recovery phrases through a deceptive interface.
2Financial Impact Analysis
The attack resulted in the theft of approximately $2.56 million across 70 distinct wallet addresses. Bitcoin losses totaled $1.77 million, while XRP accounted for $454,000, Ethereum-based assets $316,000, and Stellar $18,000. Automated scripts drained these funds within minutes of users entering their credentials on the malicious site provided by the attackers.
3Security Breach Timeline
Unauthorized access to the notification system likely began on October 11, six days before the fraudulent alerts were deployed. Ngrave detected the malicious activity at 9:30 p.m. UTC on October 17, but the first wallet was drained just six minutes later. The system was fully disabled by 10:45 p.m. that evening.
4Hardware Integrity Maintained
Ngrave confirmed that its ZERO hardware wallets and private keys remained secure throughout the incident. The attackers never cracked the physical device encryption; instead, they exploited the trust users place in official notifications. This distinction highlights that even secure hardware is vulnerable when the communication layer surrounding it is successfully compromised.
5Funds Movement and Tracking
Stolen assets were moved through various exchanges, blockchain bridges, and fresh addresses to obfuscate the trail. Bitcoin was traced into 12 addresses, while XRP underwent 54 separate transfers. Analytics firm Bitquery reported that approximately 81% of the stolen funds were moved to the Hyperliquid decentralized exchange, primarily held as Monero tokens.
6Leadership Accountability
Ngrave’s CEO issued a candid admission of failure, stating the company did not meet its fundamental security obligations. He noted that the security posture was already inadequate when he assumed leadership months prior. The company has since implemented stricter controls, including two-person approval requirements for notifications and restricted domain access protocols.
7Broader Industry Vulnerabilities
The year 2026 has seen significant security challenges for hardware wallet manufacturers, with nearly a dozen documented incidents. Previous breaches involving Ledger, Trezor, Tangem, Safepal, Bitbox02, and Coldcard have resulted in losses exceeding $180 million. These incidents typically stem from firmware vulnerabilities, third-party vendor risks, or sophisticated phishing rather than direct remote attacks.
8Future Risk Mitigation
The incident underscores the danger of peripheral services in the crypto ecosystem. While hardware remains a robust defense, the reliance on third-party notification providers creates a critical attack vector. Moving forward, users must verify all security alerts independently, as trusted communication channels can be weaponized to bypass even the most secure hardware.
Original article: Bitcoin News — Crypto Thieves Hijack Ngrave Notifications to Steal $2.56 Million