Digital hardware wallet manufacturer NGRAVE disclosed on October 19 that an attacker hijacked a third-party notification service used by its LIQUID companion app and sent users fake security alerts, luring them to click on a spoofed website and enter their 24-word recovery phrase or Perfect Key. As a result, approximately 70 wallet addresses were robbed of about $2.56 million across four blockchains. The losses included approximately $1.77 million in Bitcoin, $454,000 in XRP, $316,000 in Ethereum assets, and $18,000 in Stellar. The attacker used automated scripts to transfer the assets within minutes. NGRAVE said its ZERO hardware wallets and private keys were not directly compromised; victims voluntarily handed over their credentials during the phishing attack. The unauthorized access may have begun on October 11, and the attacker sent the fake notification on October 17. NGRAVE detected the anomaly about one minute after the notification appeared, but the first wallet had been drained just six minutes later. The notification system was shut down that evening. The company’s CEO acknowledged that it had failed to meet basic security obligations. NGRAVE has replaced the keys and added dual-approval requirements, domain restrictions, and an emergency shutdown mechanism. Affected users need to create new wallets and contact the support team. Some device information, wallet activity, IP addresses, and approximate locations may have been exposed.

$BTC $ETH $XRP