NGRAVE Phishing Attack Drains $2.56M From 70 Wallets
A phishing attack linked to NGRAVE’s LIQUID app notification service led to the theft of about $2.56 million from roughly 70 wallets across four blockchains. The NGRAVE phishing attack targeted users with fake security alerts, directing them to a counterfeit website to enter their 24-word recovery phrases or Perfect Keys. Bitcoin losses were about $1.77 million, with approximately $454,000 in XRP, $316,000 in Ethereum assets and $18,000 in Stellar assets stolen.
NGRAVE said its ZERO hardware wallet and users’ private keys were not directly compromised; victims disclosed their recovery credentials to the attackers. The company traced unauthorized access to at least October 11. After sending the fake alert on October 17, the attackers moved funds within minutes. NGRAVE disabled the notification system and says it has replaced affected access keys and added dual approval, domain restrictions and an emergency shutdown mechanism. The incident highlights the risks of phishing and third-party services, even when hardware wallets themselves remain secure.
Bearish
The immediate market impact is likely bearish for sentiment toward crypto wallet security, rather than a broad signal about the value of the affected assets. About $2.56 million was stolen, but the report says attackers obtained users’ recovery credentials through phishing and did not directly breach NGRAVE’s ZERO hardware wallet or private keys. The losses are limited relative to the overall crypto market, so a sustained market-wide price effect is unlikely on this news alone.
In the short term, affected users may sell remaining assets, move funds to new wallets or avoid interacting with wallet notifications and support links. Traders may also watch for laundering or exchange deposits linked to the stolen funds, although the article does not report any such activity. Similar wallet-phishing incidents have generally had a stronger effect on confidence in the named provider and on security-related discussion than on the prices of major tokens, unless losses are much larger or point to a systemic vulnerability.
Over the longer term, the incident could increase scrutiny of third-party notification services and encourage stronger key management, access controls and user education. NGRAVE’s response—replacing keys and adding dual approval, domain restrictions and an emergency shutdown process—may help restore confidence if implemented effectively. The broader bearish risk would rise if further compromises emerge or if the stolen assets are sold at scale; absent that, the event is best viewed as a provider-specific security and reputational concern.