Ngrave users lose $2.56 million in phishing attack

Hackers stole approximately $2.56 million from 70 Ngrave wallet users by hijacking a third-party notification provider used by the company’s LIQUID companion app. The attack, which occurred on October 17, involved sending fraudulent security alerts to users claiming their portfolios had been synced with a device in Moscow.

Upon clicking the alerts, victims were directed to a counterfeit website that prompted them to enter their 24-word recovery phrases or Perfect Keys. Once credentials were provided, automated scripts emptied the accounts within minutes. The stolen assets included $1.77 million in Bitcoin, $454,000 in XRP, $316,000 in Ethereum-based assets, and $18,000 in Stellar.

Ngrave confirmed that its ZERO hardware wallets were not breached. However, the company’s CEO stated that the firm “absolutely and utterly failed” in its security obligations. Investigations suggest unauthorized access to the notification system may have begun as early as October 11.