Fake Ngrave LIQUID Alert Drains About $2.6M From Users

On October 17, attackers hijacked a third-party provider that sends push notifications for the Ngrave LIQUID app and pushed a fake security alert to users. Some owners entered their recovery phrases on a counterfeit site and had their wallets drained. Losses are estimated at about $2.6 million. Ngrave published its incident report on October 19.

Details

According to Ngrave's report, the attackers took over access to the service that delivers LIQUID notifications. The alert claimed the wallet had been synced to a Pixel 9 in Moscow. Both the approve and deny buttons led to a copy of the Ngrave website asking for a 24-word recovery phrase or a Perfect Key.

Loss estimates differ. Bitcoin.com cites $2.56 million across 70 addresses (about $1.77 million in bitcoin), while CryptoSlate, citing Bitquery analytics, reports $2.65 million across 84 wallets. The first wallet was drained around 9:36 PM UTC on October 17 (5:36 PM ET), and the notification system was shut off about an hour later. Bitquery traced a large share of the funds to Hyperliquid.

Ngrave stresses that keys on its ZERO hardware devices were not broken; the thieves used recovery phrases the victims handed over.

What this means for the market

This is not a device flaw but a supply-chain attack through a channel users trust. Kraken CSO Nick Percoco noted that Ngrave is the second wallet maker in two days whose app notifications were used to steal recovery phrases (SecuX users faced a similar campaign a day earlier).

The rule stays the same: no app or support team should ever ask for your recovery phrase. For bitcoin's price, see the daily summary and the coin page.