ngrave

【Market Brief】Could the security alert you trust most be a trap? On October 17, attackers hijacked NGRAVE LIQUID’s notification channel to send fake warnings, directing users to spoofed pages to steal their keys. A report on October 19 said that at least $2.56 million had been stolen from around 70 addresses across 4 chains. This wasn’t a case of ZERO passwords being cracked—the trust placed in “official alerts” was exploited. When you receive a security alert, do you verify it first or click it? Join the discussion in the comments.
$BTC $XRP $ETH
#NGRAVE #钱包安全 #phishing
(Source: Bitcoinist)
⚠️Risk warning: The above is shared for informational purposes only and does not constitute investment advice. Investing involves risk; proceed with caution.

The cold wallet wasn’t hacked. What was hacked was your trust in “official notifications.”

I dug into the NGRAVE incident, and the more I read, the angrier I got. On the evening of October 17, attackers gained access to the third-party push notification provider used by its LIQUID app and sent users a “security alert” through the official channel: Your assets have synced to a Pixel 9 in Moscow. Tap “Reject,” and you’d be sent to a fake site and asked to enter your 24-word recovery phrase or Perfect Key.

According to NGRAVE’s own report, around 70 wallets were affected, with approximately $2.56 million in losses. Bitquery estimates 84 wallets and about $2.65 million, while acknowledging it can’t confirm that every wallet belonged to an NGRAVE user.

The company is now stressing that its ZERO hardware wallet wasn’t compromised. Technically, that’s true. But it sounds a lot like a security guard saying, “The vault door is fine. Someone just got hold of our intercom.” People paid for offline signing, yet the biggest vulnerability was in the company’s own internet-connected app—and its notifications were outsourced to a provider users had never even heard of.

And it gets worse. Today, beneath all kinds of posts on X about stolen funds and hacks, accounts are spamming the same message: lost coins recovered, wallet stolen, airdrop scam—contact some “best hacker and recovery expert.” People who’ve already been ripped off are getting ripped off all over again.

Pop-ups, texts, emails, official notifications—if anyone asks for your recovery phrase, they’re a scammer. Anyone claiming they can get your coins back—a “recovery expert”—is one too.

#NGRAVE #WalletSecurity

🚨 $NGRAVE UNDER PHISHING STRESS – LIQUIDITY SWEEP ALERT 🛑

Smart money 🦈 has already flagged the demand zone 📌 around $NGRAVE 's recent dip, with a cluster of order blocks absorbing sell pressure.

The phishing fallout erased ~70 wallets, carving a sudden liquidity vacuum ⚡ that institutions are now hunting; volume spikes on the 4H chart confirm a re‑accumulation phase 📊.

A retest of the broken level could offer a low‑risk entry for traders aligned with the hidden order block, yet lingering sell‑side aggression remains a threat.

💬 How are you adjusting your exposure to $NGRAVE after this sweep?

⚠️ Not financial advice. Always manage your risk. 🛡️

🏷️ #NGRAVE #SmartMoney #LiquiditySweep #Crypto

🦈 🔥

🚨 MASSIVE $NGRAVE LIQUIDITY DRAIN SHAKES SENTIMENT AS HIGH VOLATILITY OPENS PRIME ENTRIES! 💥

🌊 Over $2.5M in assets just vanished across 70 wallets caught off-guard, instantly injecting raw panic into the order books. Weak hands are rattled, but seasoned market operators recognize that chaos creates the deepest liquidity pockets.

⚡ When the tape gets violent and emotions run wild, order flow favors traders ready to capitalize on the swings rather than watching from the sidelines. 📊 Smart money thrives on this exact turbulence to position for explosive reversals. 💬 Are you stepping up to trade this volatility or staying on the sidelines until the dust settles? 👇

⚠️ Not financial advice. Always manage your risk. 🛡️

🏷️ #NGRAVE #TradingStrategy #CryptoMarket #Volatility #Momentum

⚡ 🦈

【Market Flash】$2.56 million drained in 6 hours—the weak link wasn’t the hardware wallet, but a fake alert. NGRAVE says the attacker gained access to a third-party notification system and, on the 17th, used the LIQUID app to send a fake message saying, “Your portfolio has been synced to a new device.” Users clicked through to a spoofed site and handed over their recovery credentials to “reject the sync.” Seventy wallet addresses across four networks were affected, with BTC suffering the largest losses, followed by ETH. The company has disabled notifications while investigating; LIQUID has since resumed service. A cold wallet can keep your private keys offline, but it can’t stop you from handing over your recovery credentials—when you get a security alert, will you click the link first or check the official website?\n$BTC $ETH $XMR \n#NGRAVE #硬件钱包 #CryptoSecurity\n(Source: AMBCrypto)\n⚠️Risk Disclaimer: The above is shared for market information purposes only and does not constitute investment advice. Investing involves risk; please exercise caution when entering the market.

The push notifications from a company that sells safes became a flyer board for thieves.

Belgian hardware wallet maker NGRAVE admitted defeat yesterday: on October 17, its LIQUID app flashed a security alert—your assets are being synced to a Pixel 9 in Moscow. The page had a countdown and two buttons, Allow and Deny. Either one took you to a phishing site asking for your 24 recovery words. Once handed over, a script automatically drained the wallet within minutes.

The scorecard: 70 wallets, $2.56 million vanished, and $BTC alone lost $1.77 million. The company stuck to its guns: the hardware and private keys weren’t compromised, because users had willingly handed over the keys themselves.

The timeline stings: the thieves had already snuck in on October 11. At 9:30 p.m. on the 17th, they sent the fake push notification. The company spotted it in one minute; six minutes later, the first wallet was emptied. Faster than food delivery. The CEO’s exact words: “We have utterly and completely let everyone down.”

Ledger’s supply chain, Coldcard’s official account, NGRAVE’s push notifications—safe sellers keep getting broken into, while the thieves just move on to the next door.

Place your bets in the comments: A) Staying loyal to hardware wallets is just asking for trouble. B) No safe is big enough to protect you from your own itchy fingers. Sound off.

$ETH $XRP #硬件钱包 #NGRAVE

$2.56 million. More than 70 wallets. From tapping the notification to getting drained, it took just six minutes.

NGRAVE followed up with the media today (October 21), revealing the full story behind this phishing attack. Hackers hijacked the third-party push notification service used by LIQUID, the companion app for its products. On Saturday, October 17, users received a security alert in the app that appeared to come from “official” sources. Tapping it took them to a fake website that asked them to enter their 24-word recovery phrase or Perfect Key.

Six minutes after the notification went out, the first wallet was emptied, with a script automatically transferring the funds. So far, around 70 addresses have reportedly lost $2.56 million (Bitquery, an on-chain data analytics firm, puts the figures at 84 wallets and $2.65 million). Bitcoin was hit hardest, accounting for $1.77 million. NGRAVE stressed that the hardware wallets themselves were not compromised; users had handed over their recovery phrases themselves. Device information, wallet activity, IP addresses, and approximate locations may also have been exposed, which means these victims could now face even more targeted follow-up scams.

Why should every retail investor care about this? First, the phishing message appeared directly as an app push notification and looked exactly like an official one. People naturally trust this kind of channel, making it one of the most dangerous forms of phishing. Second, many people still haven’t developed the reflex to understand that if a recovery phrase is ever entered anywhere other than on the hardware wallet’s screen, that wallet is compromised. Third, once funds are stolen, hackers may have victims’ personal information and follow up by impersonating “official customer support” or the “security team.”

Three things you can do right now. First, recovery phrases and private keys should only ever be entered using the hardware wallet’s screen. If any website, app, or person asks you to enter them, assume it’s a scam. Second, whenever you receive a security alert or upgrade reminder, check the domain on the official website and verify it through official announcement channels. Never click links in push notifications. Third, if you’ve ever entered your recovery phrase on an electronic device or website, create a new wallet now and move your funds. Don’t take any chances.

What’s the most convincing phishing message you’ve ever received? Share it in the comments so we can help everyone spot the red flags.

#NGRAVE #钱包安全 #钓鱼 #防骗

—— Web3 newbie Kai

Disclaimer: This article is for sharing security information and educational purposes only and does not constitute investment advice. Cryptocurrency trading involves extremely high risk. Please make decisions with caution.

【Market Flash】$2.65 million lost over a single seed phrase entry: According to CryptoSlate, an NGRAVE user received a phishing email impersonating customer support and was lured to a fake security center page, where they entered their seed phrase. The wallet was then taken over, and the funds were transferred and converted to ETH. On-chain tracking firm Bitquery found that some of the stolen funds were later used to buy Monero via Hyperliquid, but also cautioned that it cannot yet confirm that every wallet involved belonged to an NGRAVE user. A hardware wallet can protect against remote attacks, but not against handing over your seed phrase yourself—would you click a link in an email from your wallet provider? Share your thoughts in the comments.
$ETH $XMR $BTC
#钱包安全 #钓鱼攻击 #NGRAVE
(Source: CryptoSlate)
⚠️Risk warning: The above is shared for market information purposes only and does not constitute investment advice. Investing involves risks; please exercise caution.