Phishing Campaign Drains Millions From NGRAVE Wallets
Attackers used fake security alerts to compromise approximately 70 accounts on the mobile application.
Updated on Oct. 21, 2026 in Cybersecurity
Live Poll
Do you trust the security of the third-party services linked to your digital financial accounts?
A targeted phishing campaign has resulted in the theft of $2.56 million in cryptocurrency from 70 users of the NGRAVE LIQUID app. Attackers leveraged a compromised third-party notification service to trick users into revealing their private keys on fraudulent websites.
Why it matters
The breach highlights the risks posed by third-party service vulnerabilities even when core hardware security remains intact. By intercepting notification channels, attackers bypassed traditional security expectations, allowing them to drain funds in just minutes.
Stolen assets included $1.77 million in Bitcoin, $454,000 in XRP, $316,000 in Ether, and $18,000 in Stellar. Attackers gained access after victims entered their recovery phrases on imitation sites.
The players
NGRAVE
A blockchain security company that manufactures the NGRAVE ZERO hardware wallet and maintains the LIQUID application.
The details
While the mobile app wallets were drained, NGRAVE ZERO hardware wallets and their associated private keys were not directly compromised during the event. The attackers successfully acted within a six-minute window between sending the fake alerts and emptying the first affected wallet.
Timeline
October 11, 2026: Unauthorized access to the third-party notification service likely began.
October 17, 2026: The attackers executed the phishing campaign by sending fake security alerts to users.
The Tech Race
This incident follows the broader industry pattern of malicious actors targeting third-party service integrations to bypass robust hardware protections. It shifts the competitive landscape by forcing providers to prioritize the security of notification pipelines as strictly as the wallets themselves.
Users of digital wallet applications should exercise extreme caution with any security notifications that prompt them to visit external websites. The incident underscores the importance of never entering recovery phrases or private keys into any interface other than a trusted, native application.
The takeaway
Maintaining the secrecy of your 24-word recovery phrase is the single most effective defense against sophisticated phishing attempts. Even if a notification appears to come from a trusted company, verify the alert through official channels before taking any action on your account.
Further reading
For more information on protecting digital assets, visit the Cybersecurity section.
Live Poll
Do you trust the security of the third-party services linked to your digital financial accounts?
