Stellar

LIQUID

Ethereum

when

<p style="text-align: justify">Belgian hardware wallet provider Ngrave reported that cybercriminals stole approximately $2.56 million in cryptocurrency from users of its LIQUID companion app, after attackers took control of a third-party notification provider. The incident was officially disclosed by the company on October 19.</p>
<h2 id="attackers-exploit-notification-platform">Attackers Exploit Notification Platform</h2>
<p style="text-align: justify">The breach began on October 17 when threat actors gained access to the system Ngrave used to send push notifications for its LIQUID app. They sent fraudulent security alerts to users, warning that their portfolios had allegedly been synced with a Pixel 9 device in Moscow.</p>
<p style="text-align: justify">Recipients of these notifications were led to a counterfeit Ngrave website displaying a countdown timer. Both the “approve” and “deny” buttons on the site ultimately directed users to disclose either their 24-word recovery phrase or their Perfect Key, giving the attackers complete control of their wallets.</p>
<p style="text-align: justify">Automated scripts rapidly moved assets out of compromised wallets. Ngrave traced the losses to 70 wallet addresses on four blockchain networks.</p>
<p style="text-align: justify">The majority of stolen assets comprised $1.77 million in <a href="https://en.coin-turk.com/marathon-digital-loads-up-on-bitcoin-amid-market-volatility/" rel="noopener noreferrer nofollow">Bitcoin</a>, $454,000 in XRP, $316,000 in Ethereum-based tokens, and $18,000 in <a href="https://en.coin-turk.com/stellar-lumens-rises-12yuzde-breaks-0-18-resistance-as-market-cap-eyes-80-billion-target/" rel="noopener noreferrer nofollow">Stellar</a> lumens.</p>
<table style="border:1px solid #f1e4d8;padding:8px">
 <thead>
  <tr>
   <th>Asset</th>
   <th>Amount Stolen</th>
  </tr>
 </thead>
 <tbody>
  <tr>
   <td>Bitcoin</td>
   <td>$1.77 million</td>
  </tr>
  <tr>
   <td>XRP</td>
   <td>$454,000</td>
  </tr>
  <tr>
   <td>Ethereum-based assets</td>
   <td>$316,000</td>
  </tr>
  <tr>
   <td>Stellar</td>
   <td>$18,000</td>
  </tr>
 </tbody>
</table>
<p style="text-align: justify;background: linear-gradient(135deg,#ffffff 0%,#fffdf9 100%);border:1px solid #f1e4d8;border-left:4px solid #F69434;padding:14px 16px;border-radius:12px;color:#1e293b;font-size:15px;line-height:1.7">Mini dictionary: Ngrave is a Belgium-based company specializing in hardware wallets and digital asset security solutions. Its LIQUID app is designed to work alongside its primary product, the ZERO hardware wallet, to manage and monitor cryptocurrencies securely from mobile devices.</p>
<h2 id="chain-of-events-and-technical-details">Chain of Events and Technical Details</h2>
<p style="text-align: justify">Ngrave’s investigation found that attackers may have first secured unauthorized access to the notification provider as early as October 11, nearly a week before the fake alerts were sent. After obtaining an initial access key, hackers escalated their permissions to retrieve a second, more powerful key, which also provided access to some analytics data.</p>
<p style="text-align: justify">Ngrave detected the attack within a minute of the false alerts appearing at 9:30 p.m. UTC on October 17. However, the first wallet was emptied just six minutes later. The company disabled its notification system by 10:45 p.m., but further thefts from already compromised wallets continued until 3:51 a.m. the following morning.</p>
<p style="text-align: justify">Ngrave emphasized that its ZERO hardware wallets and users’ private keys remained uncompromised throughout the incident. The attackers succeeded by tricking customers into revealing their recovery information through phishing tactics.</p>
<p style="text-align: justify">Blockchain analysis revealed that the stolen funds were moved through multiple channels, including exchanges, blockchain bridges, and newly created addresses. According to analytics firm Bitquery, roughly 81% of the assets ended up as Monero tokens on the decentralized derivatives exchange <a href="https://en.coin-turk.com/hype-and-aster-face-headwinds-as-middle-east-tensions-keep-crypto-markets-cautious/" rel="noopener noreferrer nofollow">Hyperliquid</a>.</p>
<p style="text-align: justify;background: linear-gradient(135deg,#ffffff 0%,#fffdf9 100%);border:1px solid #f1e4d8;border-left:4px solid #F69434;padding:14px 16px;border-radius:12px;color:#1e293b;font-size:15px;line-height:1.7">Mini dictionary: Bitquery is a blockchain data analytics company that provides services for transaction tracing and compliance for digital assets across multiple blockchain networks.</p>
<h2 id="response-and-industry-context">Response and Industry Context</h2>
<p style="text-align: justify">Ngrave CEO Ruben Merre addressed the incident directly, acknowledging significant shortcomings in the firm’s security measures. He noted that these vulnerabilities existed when he assumed leadership several months earlier. The company also reported that device details, wallet activity, IP addresses, and approximate locations may have been exposed in the breach.</p>
<blockquote>
 <p>In the incident report, the CEO remarked, “the first duty of a crypto security company is to provide exactly that: security. In this, we have absolutely and utterly failed.”</p>
</blockquote>
<p style="text-align: justify">The breach comes during a challenging period for the hardware wallet market. In 2026, nearly a dozen major security incidents have affected brands such as Ledger, Trezor, Tangem, Safepal, Bitbox02, and Coldcard, with cumulative user losses exceeding $180 million in two attacks alone.</p>
<p style="text-align: justify">Ngrave has already replaced compromised keys and implemented new protective measures, including two-person approvals for notifications, tighter domain restrictions, and an emergency shutdown function.</p>
<blockquote>
 <p>Affected users are being advised to create fresh wallets and reach out to Ngrave’s support team. The company’s inquiry into the incident remains active.</p>
</blockquote>
<p>The post <a href="https://en.coin-turk.com/ngrave-says-2-56-million-in-crypto-stolen-after-fake-app-alerts-targeted-users/" rel="noopener noreferrer nofollow">Ngrave says $2.56 million in crypto stolen after fake app alerts targeted users</a> appeared first on <a href="https://en.coin-turk.com" rel="noopener noreferrer nofollow">COINTURK NEWS</a>.</p>

Ngrave says $2.56 million in crypto stolen after fake app alerts targeted users

Table of Contents

COINTURK NEWS

Other articles published on Oct 21, 2026

Join our free newsletter for daily crypto updates!