Ngrave phishing: $2.56 million left 70 wallets after a hijacked push provider

Ngrave, the Belgian hardware wallet maker, published an incident report on October 19, 2026 describing an uncomfortable gap: attackers took over the account of an external provider that sends push notifications for the companion app LIQUID, and used that channel to send users fake security alerts. Anyone who followed the alert and entered their recovery words lost their balance. By the company's count, around $2.56 million left roughly 70 wallet addresses across four networks.

The devices themselves were not the target. Ngrave states explicitly that neither the code of the LIQUID app nor the ZERO hardware nor the keys stored on it were touched. What was attacked is the route the company uses to speak to its customers. That is what makes the case relevant to anyone holding crypto assets in self-custody, because almost every wallet app sends notifications today.

What happened to the LIQUID notifications on October 17

On the evening of October 17, 2026, at around 21:30 UTC, a push message went out to LIQUID users that looked like a security alert from the manufacturer. The text claimed the recipient's portfolio had been synchronised on a new device: a Pixel 9 in Moscow. A message of that kind produces exactly the reaction the attackers were after, namely acting fast without thinking.

The link in the message led to a replica of the Ngrave site. A countdown was running there, next to a button to confirm and one to reject. Tapping reject took the user to a page asking for the Perfect Key or the 24-word recovery phrase. The reflex to fend off a stranger's access therefore led straight into the trap.

The timeline in the company's report is tightly spaced. At 21:31 the team noticed the message; by 21:36 the first wallet was empty. At 21:40 Ngrave revoked the first stolen access key, but the attackers kept sending through a second one. At 22:30 a warning was up on X, ten minutes later a warning email went out to customers, and at 22:45 the company shut down notification sending entirely. The last theft traced falls on October 18 at 03:51.

The hijacked push provider: how one access key led to the second

Ngrave does not send its app's notifications itself but through an external provider. That provider is who the attackers hit. They first obtained one access key and used it to reach a second with wider rights. The second key let them send messages to LIQUID users and read part of the usage data.

The report dates the earliest sign of that access to October 11. Six days therefore passed between the intrusion and the fake alert, with nobody noticing anything. Only at 09:37 on October 18, according to the company, had every key in use by live systems been replaced.

An access key at a service provider is a string with which one program identifies itself to another, comparable to a password for machines. It sits in server configurations, not in your wallet. That is why the best hardware will not help you if that key falls into the wrong hands: the message that then reaches you carries the genuine sender.

$2.56 million to $2.65 million: which coins left which wallets

Ngrave puts the traced damage at around $2.56 million, calculated at the prices of October 17, spread across roughly 70 wallet addresses and four networks. The company explicitly calls that figure a floor. The analytics firm Bitquery arrives at around $2.65 million across 84 wallets in a wider count, as CryptoSlate reports. Transaction data alone, though, cannot establish that every one of those wallets belonged to an Ngrave customer. The defensible range therefore runs from $2.56 million to $2.65 million.

The manufacturer's breakdown by network looks like this:

• Bitcoin: $1.77 million. The amounts were pooled in one attacker address and distributed from there across twelve newly created addresses.
• XRP: $454,000. That sum went to the swap service ChangeNOW in 54 separate deposits.
• Ethereum: around $316,000. The tokens were sold for 130.47 ETH and moved to other blockchains via the service LI.FI. In one place the report names $313,000 as the bridged sum and around $3,000 in unsold tokens left sitting in the attackers' wallets.
• Stellar: $18,000, sent to an address the company believes belongs to an exchange.

The speed stands out. Barely six hours separated the first emptied wallet from the last theft traced. Anyone who read the 22:40 warning email the following morning no longer had a chance to intervene.

What Ngrave says it did not lose

The report narrows the damage in several places. Untouched, it says, were the code of the LIQUID app, the ZERO devices along with the secrets stored on them, and customers' names and delivery addresses, which sit in a separate system. Private keys do not leave a ZERO device, according to the manufacturer, and the attackers had no access to the devices.

Recovery phrases and Perfect Keys did not leak either on this account, with one exception: those users typed into the fake page themselves. That distinction is the heart of the case. In technical terms, custody held. What broke was trust in the channel the manufacturer uses to send alerts.

The data list: what the attackers could read about LIQUID users

Alongside the money, a data set was lost, and it weighs more heavily on the months ahead than the sum suggests. On October 17 the attackers copied the notification list, according to the company. It holds, per phone, a token, the device model, the operating system, the LIQUID version, language, country, time zone, usage data, an internal app identifier and possibly the IP address along with an approximate location.

Also readable were the swap history with crypto addresses, amounts and timestamps, more recent balance data, and general usage data from the app. Whether those were copied as well is still being examined by the company. For a small number of customers, the attackers could additionally see email addresses and order numbers from deletion requests. Ngrave has reported the disclosure to the Belgian data protection authority.

For LIQUID users, that means expecting precisely targeted approaches over the coming months. Someone who knows which device you use, which country you live in and which amounts you last swapped no longer writes a bulk email but a message that fits your situation. How to spot these follow-up waves after a data leak is set out, using other incidents as examples, in our guide to crypto phishing after a data breach.

MiCA supervision: a hardware wallet maker does not fall under it

For investors in Germany, a sober reading of the legal framework is worth having. The EU's MiCA regulation governs providers that hold, exchange or broker crypto assets for others. A manufacturer that sells you a device for keeping your own keys is not holding anything for you. It therefore does not come under the same supervision as an exchange with a BaFin licence.

The practical consequence is uncomfortable. In self-custody there is no deposit guarantee, no claim for compensation against a supervisory authority and no fund that steps in. Give away the recovery words and you have handed over control, and no body can reverse the transfer. That is the price of independence, and it belongs in the decision when choosing a device. Which models can be bought in Germany, and how they differ in handling and recovery, is shown in our hardware wallet comparison.

Anyone unwilling to pay that price has an alternative that carries different risks of its own: custody with a supervised provider. There, a company under supervision is liable, but control over the keys no longer sits with you. Which trading venues hold a MiCA authorisation for the German market is listed in our overview of regulated crypto exchanges.

Police report, case number and exchange freeze: the route for victims in Germany

Ngrave names concrete steps in the report, and they apply to any comparable case, whoever the manufacturer. Anyone who entered their recovery phrase or Perfect Key on the fake page should treat the affected wallet as compromised on every network, move any remaining balance to a new wallet with a new phrase, and send nothing more to the old addresses. According to the company, that holds even if the page rejected the entry as incorrect or only some of the words were typed in.

Anyone who merely opened the link or tapped the buttons without entering words counts as unaffected on this account. One note from the report matters here: a web app named "NGRAVE Security Center", which may have ended up on the home screen when tapped, does not come from the manufacturer and should be deleted.

For contact, the company points to support@ngrave.io; cases carry a reference with the prefix OSH. To help trace funds, victims are asked to send transaction IDs, their own and the destination addresses, and the approximate time of entry, but never the recovery phrase itself. And one point concerns victims in Germany directly: Ngrave advises filing a criminal complaint locally and passing on the case number, because exchanges as a rule require a police reference before they will freeze a balance. In Germany the local police station takes the report, and several federal states also offer an online police desk for it.

The company says it has shut down the notification service, removed the fake messages, reported the phishing site to the registrar for takedown, preserved logs, brought in the authorities and asked exchanges and bridge services to freeze the funds.

The lesson from the incident: the attack route ran through the notification channel

Ngrave is unusually hard on itself in its own report. The chief executive writes that the internal notification system was infiltrated "by sophisticated attackers", calls the method "a classic trick, and one that we at NGRAVE should have prevented" and states: "In this, we have absolutely and utterly failed." The goal is to be the safest company in the world, he writes, and the company is a long way from that today. It can all be read in the company's incident report of October 19, 2026.

A series of rebuilds has been announced, which the company describes as not yet complete. LIQUID is to be able to open official Ngrave addresses only in future, so notifications and banners can no longer call up outside pages. Added to that are a key that can only send and not read, access limited to the company's own servers with two-factor sign-in, alerts on unusual use and on bulk exports, a four-eyes principle for every message, short-lived keys rotated at least every 90 days, and a single switch that shuts down all sending routes.

The case fits a pattern seen several times this year. In October the analytics firm SlowMist reported fake firmware notices in the name of another manufacturer, which we covered under fake Ledger firmware updates. The attack surface is shifting from the hardware to everything standing around it: app, notification, customer list, delivery provider.

One rule of thumb carries through almost all of these cases: no reputable manufacturer and no exchange ever asks for your recovery phrase, your Perfect Key or a payment. Ngrave makes exactly that point again in the report and adds a warning about providers promising, for a fee, to recover stolen crypto assets. Such offers, the company says, are fraudulent without exception.

Ngrave phishing: anyone who typed the words needs a new wallet

The incident exposed no gap in custody itself, but one in the trust placed in the sender of a message. Three steps follow from that:

1. Establish whether you are affected, and act accordingly. If you received a synchronisation alert on the evening of October 17 and then entered words, the wallet is burnt. Set up a new one with a fresh recovery phrase, move any remaining balance there and file a criminal complaint, so that you hold the case number for exchange freezes. Which device is suitable for it is covered in the hardware wallet comparison.
2. Switch notifications from acting to checking. Treat every push message and every email as no more than a prompt to look for yourself, in the app or in the block explorer, and never follow a link from the alert. Genuine access to your balance shows up on the blockchain, not in a notification. Which applications are suited to that, and how they handle approvals, is shown in the software wallet comparison.
3. Decide deliberately how much you hold yourself. Self-custody means full control and full liability; custody with a supervised provider distributes both differently. For larger holdings, splitting them is common practice. Which venues are authorised for the German market is listed in the overview of regulated crypto exchanges.

(As of October 23, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)