- Trending
- Comments
- Latest
According to NGRAVE’s official incident report, customers received notifications claiming their cryptocurrency portfolios had been synchronized with a Google Pixel 9 device in Moscow. The messages were designed to resemble legitimate security alerts, creating the impression that an unauthorized device had accessed users’ wallets.
Recipients who followed the notification were taken to a fraudulent NGRAVE website. The page displayed a countdown timer and presented users with two options: approve or deny the supposedly suspicious activity. Rather than protecting customers, both options led to a request for their wallet recovery credentials.
Victims were prompted to provide either their 24-word recovery phrase or their Perfect Key, credentials that could allow an attacker to reconstruct and control a wallet. Once the information was obtained, automated scripts were used to transfer funds out of compromised accounts within minutes.
The scale of the Ngrave exploit became clearer as the company traced the stolen assets across four blockchain networks. Bitcoin represented the largest portion of the losses, at approximately $1.77 million. The investigation also identified about $454,000 in XRP, $316,000 in Ethereum-based assets and $18,000 in Stellar.
Together, these transfers amounted to approximately $2.56 million stolen from 70 wallet addresses. The figures highlight the effectiveness of phishing attacks that exploit users’ trust in official communications rather than attempting to break the underlying cryptographic protections of a hardware wallet.
The incident also illustrates why legitimate-looking notifications should not automatically be treated as proof of authenticity. Even when a message appears to originate from a familiar service, users should verify security warnings through independently accessed official channels before entering recovery information.
NGRAVE’s investigation indicated that unauthorized access may have begun as early as October 11, approximately six days before the fraudulent notifications appeared. According to the incident report, attackers obtained one access key and used it to acquire another with broader permissions, including access to certain analytics information.
The company detected the malicious notifications within a minute of their appearance at approximately 9:30 p.m. UTC on October 17. However, the speed of detection did not prevent immediate financial losses. The first reported wallet was drained six minutes after the alerts appeared.
NGRAVE subsequently disabled its notification system by 10:45 p.m. UTC. Nevertheless, transfers from wallets whose recovery credentials had already been compromised continued until 3:51 a.m. the following morning.
This timeline reveals an important distinction between stopping an intrusion and containing its consequences. Disabling the notification infrastructure could prevent additional fraudulent messages, but it could not restore control over wallets whose owners had already disclosed their recovery information.
The company maintained that its ZERO hardware wallets and private keys remained secure. Instead, the attackers exploited the notification infrastructure and persuaded customers to disclose the credentials required to access their funds.
The Ngrave exploit therefore involved a combination of third-party access weaknesses, deceptive communications and social engineering. It also raised questions about the permissions granted to external service providers and the safeguards used to protect notification systems.
For cryptocurrency companies, the incident reinforces the need to limit access privileges, protect authentication keys, monitor unusual activity and maintain emergency procedures capable of quickly disabling compromised services. Security controls must also account for the possibility that an attacker may use a legitimate communication channel to distribute fraudulent instructions.
The financial consequences extended beyond the initial wallet transfers. NGRAVE reported tracing bitcoin into 12 addresses, while XRP moved through 54 transfers. The stolen assets were subsequently moved through cryptocurrency exchanges, blockchain bridges and newly created addresses, complicating efforts to follow their movement.
Blockchain analytics firm Bitquery also published findings concerning the stolen funds. Its report stated that “most of it now sits on Hyperliquid as a Monero token.” The report estimated that approximately 81% of the stolen funds had reached the derivatives trading platform.
These movements illustrate how stolen cryptocurrency can be dispersed across different services and blockchain environments, making investigations more complicated. Although public blockchain records can help investigators follow transactions, identifying the individuals controlling destination addresses and recovering the assets can be considerably more difficult.
NGRAVE’s chief executive offered a direct assessment of the company’s responsibility in the incident, acknowledging that its security measures had fallen short of the standard expected of a cryptocurrency security provider.
“In my humble opinion, the first duty of a crypto security company is to provide exactly that: security. In this, we have absolutely and utterly failed.”
The statement reflected the seriousness of the breach and the company’s recognition that protecting the physical wallet alone was insufficient. The executive also acknowledged that the company’s security posture had been inadequate when he assumed leadership several months earlier.
Following the Ngrave exploit, the company said it had replaced compromised keys and outlined additional safeguards for its notification infrastructure. Planned measures included requiring approval from two people for sensitive operations, restricting permitted domains and introducing emergency shutdown capabilities.
NGRAVE also urged affected customers to establish new wallets and contact its support team. Users who believe their recovery phrases or other wallet credentials have been exposed should treat the affected wallets as compromised and move any remaining assets to a newly generated wallet using a secure device and recovery information that has never been disclosed.
The company’s investigation remained ongoing at the time of its disclosure, and the reported losses underscore the importance of clear communication with affected customers.
The incident comes amid a difficult period for hardware-wallet providers and the wider cryptocurrency security industry. Reports during 2026 have described security incidents involving manufacturers and products associated with Ledger, Trezor, Tangem, SafePal, BitBox02 and Coldcard.
The reported incidents have involved different types of weaknesses, including phishing, third-party service compromises, firmware concerns and physical security risks. The supplied report also cited losses exceeding $180 million across two incidents, although those figures concern separate cases and should not be attributed to the NGRAVE breach.
The distinction matters because hardware wallets are designed primarily to protect private keys and reduce exposure to online threats. They cannot, however, prevent every form of fraud if users are manipulated into voluntarily disclosing their recovery phrases or approving actions they do not understand.
The Ngrave exploit demonstrates how attackers can target the broader ecosystem surrounding a wallet, including mobile applications, notification providers and customer support channels. In such cases, the device itself may continue operating as designed while the user is deceived into compromising their own funds.
For users, a central lesson is to regard unsolicited security warnings with caution. Recovery phrases should never be entered into a website simply because a notification claims that an account is under threat. Security incidents should instead be verified by opening the provider’s official application or manually navigating to its established website.
For manufacturers, the incident highlights the importance of securing third-party integrations with the same seriousness applied to wallet hardware and private-key management. Strict access controls, rapid incident response, independent security reviews and carefully designed customer alerts can help reduce the risk of similar attacks.
Ultimately, the NGRAVE case shows that cryptocurrency security depends on more than strong hardware. The services surrounding a wallet, the permissions granted to external providers and the decisions users make when confronted with urgent warnings all contribute to the protection of digital assets.
As the investigation continues, the recovery of the stolen funds remains uncertain. The breach nevertheless offers a clear warning to the industry: a security system can become a point of vulnerability when criminals gain control of the messages users trust.
Copyright © 2025 - The Bit Gazette.
