Phishing Attack Drains $2.56 Million From NGRAVE Users
Attackers exploited a third-party notification service to trick users into revealing their recovery phrases.
Updated on Oct. 21, 2026 in Cybersecurity
Live Poll
Do you trust the security of the third-party services linked to your digital financial accounts?
A phishing campaign targeting users of the NGRAVE LIQUID app resulted in the theft of $2.56 million in digital assets from roughly 70 wallets. While the hardware wallets themselves remained secure, attackers successfully extracted private recovery phrases through a compromised third-party notification service.
Why it matters
The incident highlights the persistent risk of third-party supply chain vulnerabilities in cryptocurrency custody, where a single breached service provider can bypass otherwise robust hardware security. It demonstrates how attackers are increasingly leveraging trusted communication channels to deceive users into surrendering sensitive credentials.
The attackers stole $1.77 million in Bitcoin, $454,000 in XRP, $316,000 in Ether, and $18,000 in Stellar. The breach occurred when users were directed to imitation websites and prompted to input their 24-word recovery phrases, enabling unauthorized access within six minutes of the fake notification.
The players
NGRAVE
A developer of digital asset self-custody solutions, including the NGRAVE ZERO hardware wallet and the LIQUID companion application.
The details
The attack exploited a third-party notification service to distribute fraudulent security alerts to app users. By mimicking legitimate system warnings, the phishers directed targets to spoofed websites where they were coerced into entering their 24-word Perfect Key—the recovery phrase used to restore wallet access. Because the recovery phrase grants full control of the associated assets, the attackers were able to drain the funds despite the underlying hardware wallet's private keys remaining uncompromised.
Timeline
October 11, 2026: Unauthorized access to the third-party notification service potentially began.
October 17, 2026: Attackers disseminated fake security alerts to app users.
The Tech Race
This incident highlights the ongoing vulnerability of self-custody infrastructure to supply chain attacks. It follows a pattern set by the 2020 Twitter accounts hijack, where the breach of a single third-party interface undermined the security of the primary platform.
Users of the NGRAVE LIQUID app may have had device info and IP addresses exposed during the breach, necessitating heightened vigilance against future phishing attempts. NGRAVE has since implemented two-person approval and domain restrictions to mitigate the risk of similar unauthorized notifications.
The takeaway
The attack underscores that even hardened hardware security is effectively bypassed when a user is convinced to manually reveal their recovery phrase. Monitor official company channels for any changes to security protocols or new authentication requirements following this incident.
Further reading
For more on evolving threats to digital asset integrity, visit our Cybersecurity section.
Live Poll
Do you trust the security of the third-party services linked to your digital financial accounts?
