Key takeaways
- Attackers took over the outside provider that sends NGRAVE LIQUID push notifications and sent a fake alert on October 17.
- The fake page asked for recovery phrases or Perfect Key backups, and NGRAVE estimates about $2.56 million was drained from roughly 70 wallets.
- NGRAVE says ZERO devices and private keys were not breached; victims should move remaining funds to new wallets and contact support.
The Ngrave hack is a hard lesson for anyone who trusts a phone alert. Belgian hardware wallet maker NGRAVE says attackers hijacked the outside service that sends push notifications for its LIQUID app, pushed a fake security warning to users, and tricked some of them into handing over their recovery phrases. The company estimates about $2.56 million was drained from roughly 70 wallet addresses, according to reports from Parameter, Bitcoin.com News and TokenPost. The hardware itself was not cracked. People were.
What happened in the Ngrave hack
NGRAVE sells the ZERO, a cold storage device, and LIQUID, the companion phone app people use to view and manage their portfolio. In an incident report posted on its blog on October 19, the company said attackers took over the access of a provider that delivers LIQUID's push notifications and used it to send a fake security alert on October 17.
According to Parameter and Bitcoin.com News, the intrusion may have started as early as October 11. The attackers first got hold of one access key, then used it to obtain a second key with wider permissions, including partial access to analytics data. Nobody outside the company has named the notification provider.
The fake alert
At about 9:30 p.m. UTC on October 17 (5:30 p.m. Eastern), LIQUID users received an alert claiming their portfolio had just been synced with a Pixel 9 in Moscow, Russia. Tapping it opened a copy of the NGRAVE website with a countdown clock and two buttons, one to approve the activity and one to reject it.
Both buttons led to the same place. The page asked for the wallet's 24 word recovery phrase or its "Perfect Key" backup, NGRAVE's alternative recovery method. Either one is enough to rebuild a wallet on another device, which is exactly what the attackers wanted.
Six minutes to empty a wallet
The theft moved fast. Parameter and Bitcoin.com News both report that NGRAVE spotted the malicious notifications within about a minute, but automated scripts emptied the first victim's wallet six minutes after the first alert went out. The company shut down its notification system by 10:45 p.m. UTC, yet withdrawals from wallets whose phrases had already been entered kept going until 3:51 a.m. the next morning.
How much was stolen
NGRAVE's own estimate, based on October 17 prices, breaks down like this, according to Parameter and Bitcoin.com News:
- Bitcoin: about $1.77 million
- XRP: about $454,000
- Ethereum based tokens: about $316,000
- Stellar: about $18,000
TokenPost notes that NGRAVE treats the $2.56 million total as a minimum while it checks other networks and matches it against customer reports. A separate on chain count cited by TokenPost found about $2.65 million taken from 84 wallets across six blockchains, though the outlet cautions that transaction records alone cannot prove every one of those wallets belonged to an NGRAVE customer.
Where the money went
Most of the loot did not stay in bitcoin for long. Blockchain data firm Bitquery estimated that about 81% ended up on Hyperliquid, with Bitcoin.com News quoting it as saying "most of it now sits on Hyperliquid as a Monero token." TokenPost reported that roughly $2.16 million was spent on XMR1 tokens across 39 Hyperliquid accounts, and that none had been sold or withdrawn as of the morning of October 19. NGRAVE also traced bitcoin into 12 addresses and followed XRP through 54 transfers.
Why this matters for hardware wallet owners
The uncomfortable part of this story is that the security model worked as designed and people still lost money. NGRAVE says its ZERO devices, stored private keys and LIQUID app code were not breached. The weak spot was a trusted channel, the official app's own notifications, being turned against its users.
That is a smarter trick than the usual phishing email. Most crypto owners have learned to ignore random texts and messages. Far fewer would question an alert that pops up from the real app they installed to protect their savings. Add a scary location, a ticking clock and a button that looks like it will stop the threat, and plenty of careful people will act before they think.
NGRAVE's leadership did not try to soften it. In the disclosure, the company's CEO wrote, as quoted by Parameter and Bitcoin.com News: "In my humble opinion, the first duty of a crypto security company is to provide exactly that: security. In this, we have absolutely and utterly failed." Parameter reports he took over months before the incident and considered the company's security posture inadequate at the time.
It also fits a rough year for the category. Both Parameter and Bitcoin.com News count about a dozen hardware wallet security incidents in 2026 involving brands such as Ledger, Trezor, Tangem, SafePal, BitBox02 and Coldcard. We covered one of them when Ledger paused wallet sales in several countries after implant thefts.
Who is affected
The direct victims are LIQUID users who received the alert and typed their recovery phrase or Perfect Key into the fake page. NGRAVE's figure points to about 70 wallet addresses, and no outlet has reported a count of individual people.
A wider group may face follow up risk. NGRAVE said the attackers may have seen device details, wallet activity patterns, IP addresses and approximate locations, according to Parameter and Bitcoin.com News. Bitcoin.com News noted that this kind of data raises the chance of targeted scams later. If you use LIQUID and did nothing wrong on October 17, you could still be on a scammer's list.
What to do now
If you entered your recovery phrase or Perfect Key on that page, treat the wallet as gone. NGRAVE has told affected users to create new wallets right away and contact its customer support, according to Parameter and Bitcoin.com News. Move any remaining funds to a freshly generated wallet on a clean setup, and never reuse the old phrase.
For everyone else, a few habits close this kind of hole:
- Never type a recovery phrase into a website or app. No legitimate wallet company will ask for it to "verify" or "secure" an account. The phrase only belongs on the device itself during a restore.
- Distrust urgency. Countdown timers and "suspicious login" warnings are designed to rush you. Close the alert and open the official app or site directly.
- Expect targeted follow ups. Since some user data may have been exposed, be wary of emails, calls or messages that mention your NGRAVE device or holdings.
- Consider limiting notifications. Fewer push alerts from finance apps means fewer chances to tap a bad one.
Cold storage keeps coming up in the news, from the six cold wallets Turkish police seized in the Richard Heart case to the new Ledger Atom signer, and the same rule applies to all of them: the device is only as safe as the phrase behind it.
What NGRAVE is changing
According to TokenPost, NGRAVE closed the compromised access, replaced the keys used by its live systems and asked exchanges and bridge services to freeze stolen funds. It also plans to restrict LIQUID links so they can only point to official company sites.
Parameter and Bitcoin.com News report further changes: rotating all compromised access keys, requiring two person approval for sensitive operations, adding domain restriction rules and building an emergency shutdown switch. The investigation is ongoing. None of the reports we reviewed describe a refund or compensation plan, and none mention law enforcement involvement so far.
What to watch next
Three things are worth tracking. First, whether NGRAVE offers any compensation to people who lost funds. Second, whether Hyperliquid or other venues can freeze the XMR1 tokens before they are moved, since TokenPost said none had been sold as of October 19. Third, whether other wallet makers audit the outside services that power their own app alerts, because this attack path is not unique to NGRAVE.
For more security and market coverage, visit our crypto news page or read why Coinbase wants bitcoin's quantum upgrade to start now.
Frequently asked questions
Was the NGRAVE ZERO hardware wallet hacked?
No. NGRAVE says the ZERO devices, private keys and LIQUID app code were not breached. Attackers abused the app's push notification provider to send a fake alert and phish recovery phrases.
How much money was stolen in the Ngrave hack?
NGRAVE estimates about $2.56 million from roughly 70 wallet addresses, mostly in bitcoin and XRP. An independent on chain count cited by TokenPost puts it near $2.65 million.
I use LIQUID but never entered my phrase. Am I safe?
Your funds should be safe, but some personal data such as IP addresses and approximate locations may have been exposed, so watch for targeted scam messages.
What should victims do?
Create a new wallet immediately, move any remaining funds there and contact NGRAVE support, as the company has advised.
Share this story
Spotted an error? Tell us
