Belgian hardware wallet maker Ngrave disclosed that a phishing campaign hijacked the push notification service for its LIQUID companion app, resulting in approximately $2.56 million in stolen crypto assets. The breach allowed attackers to send authentic-looking security alerts to customers on October 17, 2026, after compromising a third-party provider responsible for delivering notifications.
The fraudulent messages claimed that the user’s portfolio had been synchronized with a Pixel 9 device in Moscow and urged immediate review. Because the alerts arrived through the same official notification channel used by Ngrave, they appeared legitimate. Users who opened the alert were directed to a convincing counterfeit version of the Ngrave website. The fake page displayed a countdown timer and offered what seemed to be an option to approve or deny the activity. Both choices led to the same request: victims were asked to enter either their 24-word recovery phrase or their Perfect Key. Once credentials were submitted, automated scripts recreated the wallets and drained the associated accounts within minutes.
Ngrave traced roughly $2.56 million stolen from about 70 wallet addresses across four blockchains, using October 17 prices. The breakdown included approximately $1.77 million in Bitcoin, $454,000 in XRP, $316,000 in Ethereum-related assets, and $18,000 in Stellar. The company emphasized that its ZERO hardware devices and the private keys stored on them were never breached. The losses occurred solely because victims voluntarily provided recovery credentials on the phishing site.
Unauthorized access to the notification provider may have begun as early as October 11. Attackers first obtained one access key and then used it to acquire a second key with broader permissions, including the ability to send messages and view certain analytics data. Ngrave detected the malicious alerts within about a minute of their appearance around 21:30 UTC on October 17. The first wallet was nevertheless drained six minutes later. The company cut off the initial key by 21:40 UTC, but alerts continued through the second key until all notification sending was shut down at 22:45 UTC. Thefts from already-compromised wallets persisted for several more hours, with the last traced drain occurring at 03:51 UTC on October 18.
Stolen funds were rapidly moved through exchanges, bridges, and fresh addresses. Bitcoin was split across multiple new addresses, XRP was deposited to an exchange in dozens of transfers, and Ethereum assets were bridged onward. Ngrave is sharing attacker addresses and transaction details with law enforcement and has requested that exchanges and bridge operators freeze related balances.
Ngrave’s CEO acknowledged that the company had “absolutely and utterly failed” its fundamental duty to provide security. The firm has replaced the compromised keys and is implementing tighter controls, including dual approval for notifications, domain restrictions preventing alerts from opening external sites, short-lived keys, and an emergency shutdown mechanism for the notification system. Affected users are advised to treat the original wallets as compromised on every network, move any remaining funds to newly generated wallets, and contact Ngrave support. The episode highlights that even air-gapped hardware wallets remain vulnerable when surrounding software channels and user trust can be manipulated.
