Belgian hardware wallet provider Ngrave reported that cybercriminals stole approximately $2.56 million in cryptocurrency from users of its LIQUID companion app, after attackers took control of a third-party notification provider. The incident was officially disclosed by the company on October 19.
Attackers Exploit Notification Platform
The breach began on October 17 when threat actors gained access to the system Ngrave used to send push notifications for its LIQUID app. They sent fraudulent security alerts to users, warning that their portfolios had allegedly been synced with a Pixel 9 device in Moscow.
Recipients of these notifications were led to a counterfeit Ngrave website displaying a countdown timer. Both the “approve” and “deny” buttons on the site ultimately directed users to disclose either their 24-word recovery phrase or their Perfect Key, giving the attackers complete control of their wallets.
Automated scripts rapidly moved assets out of compromised wallets. Ngrave traced the losses to 70 wallet addresses on four blockchain networks.
The majority of stolen assets comprised $1.77 million in Bitcoin, $454,000 in XRP, $316,000 in Ethereum-based tokens, and $18,000 in Stellar lumens.
| Asset | Amount Stolen |
|---|---|
| Bitcoin | $1.77 million |
| XRP | $454,000 |
| Ethereum-based assets | $316,000 |
| Stellar | $18,000 |
Mini dictionary: Ngrave is a Belgium-based company specializing in hardware wallets and digital asset security solutions. Its LIQUID app is designed to work alongside its primary product, the ZERO hardware wallet, to manage and monitor cryptocurrencies securely from mobile devices.
Chain of Events and Technical Details
Ngrave’s investigation found that attackers may have first secured unauthorized access to the notification provider as early as October 11, nearly a week before the fake alerts were sent. After obtaining an initial access key, hackers escalated their permissions to retrieve a second, more powerful key, which also provided access to some analytics data.
Ngrave detected the attack within a minute of the false alerts appearing at 9:30 p.m. UTC on October 17. However, the first wallet was emptied just six minutes later. The company disabled its notification system by 10:45 p.m., but further thefts from already compromised wallets continued until 3:51 a.m. the following morning.
Ngrave emphasized that its ZERO hardware wallets and users’ private keys remained uncompromised throughout the incident. The attackers succeeded by tricking customers into revealing their recovery information through phishing tactics.
Blockchain analysis revealed that the stolen funds were moved through multiple channels, including exchanges, blockchain bridges, and newly created addresses. According to analytics firm Bitquery, roughly 81% of the assets ended up as Monero tokens on the decentralized derivatives exchange Hyperliquid.
Mini dictionary: Bitquery is a blockchain data analytics company that provides services for transaction tracing and compliance for digital assets across multiple blockchain networks.
Response and Industry Context
Ngrave CEO Ruben Merre addressed the incident directly, acknowledging significant shortcomings in the firm’s security measures. He noted that these vulnerabilities existed when he assumed leadership several months earlier. The company also reported that device details, wallet activity, IP addresses, and approximate locations may have been exposed in the breach.
In the incident report, the CEO remarked, “the first duty of a crypto security company is to provide exactly that: security. In this, we have absolutely and utterly failed.”
The breach comes during a challenging period for the hardware wallet market. In 2026, nearly a dozen major security incidents have affected brands such as Ledger, Trezor, Tangem, Safepal, Bitbox02, and Coldcard, with cumulative user losses exceeding $180 million in two attacks alone.
Ngrave has already replaced compromised keys and implemented new protective measures, including two-person approvals for notifications, tighter domain restrictions, and an emergency shutdown function.
Affected users are being advised to create fresh wallets and reach out to Ngrave’s support team. The company’s inquiry into the incident remains active.
