The scariest phishing message is the one that arrives through the official app. On Saturday evening, October 17, 2026, owners of Belgian hardware wallet maker Ngrave’s LIQUID app received a push alert saying their portfolio had just synced to a new device — a Pixel 9 in Moscow. The alert was real in the sense that it came through Ngrave’s own notification channel. Everything else about it was fake.
Five minutes after Ngrave noticed the message, the first wallet was empty.
Key facts
- Attackers hijacked Ngrave’s external push-notification provider and sent fake alerts at about 21:30 UTC on October 17, 2026.
- The link led to a replica Ngrave site asking for the Perfect Key or the 24-word recovery phrase.
- Ngrave puts traced losses at about $2.56 million across roughly 70 wallets and four networks, calling it a floor; Bitquery counts about $2.65 million across 84 wallets.
- Bitcoin losses were $1.77 million, XRP $454,000, Ethereum about $316,000 and Stellar $18,000.
- Ngrave found the first sign of intrusion dated October 11 — six days before the fake alert.
- Ngrave says the LIQUID app code, ZERO devices, stored secrets and customer names and delivery addresses were not touched.
How did the Ngrave phishing attack work?
The attackers didn’t break the wallet; they borrowed its voice. They gained access to the third-party service Ngrave uses to send push notifications and pushed a fake “new device synced” alert to LIQUID app users. The alert linked to a convincing copy of Ngrave’s site that asked for the user’s Perfect Key or 24-word recovery phrase. Anyone who entered it lost their funds.
Ngrave’s incident report, dated October 19, lays out the timeline. Ngrave noticed the message at 21:31 UTC; the first wallet was emptied by 21:36. It revoked the first stolen access key at 21:40, but the attackers kept sending through a second key. A warning went out on X at 22:30, an email at 22:40, and notifications were shut down at 22:45. The last traced theft happened at 03:51 on October 18.
The channel was real. The message wasn’t. Your seed doesn’t care which.
How much was stolen from Ngrave users?
Ngrave counts about $2.56 million at October 17 prices across roughly 70 wallets on four networks and calls that a floor. CryptoSlate, citing Bitquery, reports a wider count of about $2.65 million across 84 wallets.
| Network | Traced loss | Where it went |
|---|---|---|
| Bitcoin | $1.77M | Pooled, then split across 12 new addresses |
| XRP | $454K | An instant swap service, in 54 deposits |
| Ethereum | ~$316K | Sold and bridged via LI.FI |
| Stellar | $18K | Address believed to belong to an exchange |
What data was exposed
Notification-list fields such as device model, OS, app version, language, country, time zone and possibly IP and approximate location were exposed. Swap history, amounts and recent balance data were also readable, and Ngrave is still checking whether they were copied. For a small number of customers, email addresses and order numbers from deletion requests were visible. Ngrave has reported the incident to the Belgian data protection authority.
What should Ngrave users do now?
If you entered your recovery phrase or Perfect Key on the fake site, treat it as compromised and move any remaining funds to a new wallet with a fresh seed. Delete any web app called “NGRAVE Security Center” — it is not from the manufacturer. Victims can contact [email protected] with transaction IDs, destination addresses and approximate time of entry — but never the recovery phrase.
Ngrave’s CEO was unusually blunt about the failure: “In this, we have absolutely and utterly failed.” Planned fixes include a send-only key, server-restricted access with two-factor sign-in, bulk-export alerts, four-eyes approval for messages and key rotation at least every 90 days.
What this means for swap users
This is the third wallet-brand phishing wave in a month, after Coldcard’s hijacked X account and fake Ledger firmware pages. The rule that would have saved every victim is the same: no real alert, app or support agent ever needs your seed. A non-custodial swap on SwapZilla only asks for a receiving address — and you should copy that from your wallet, not from a message.
Instant swap services were part of the laundering route here, as they often are. Reputable providers screen deposits and can hold funds linked to reported thefts, which is why victims should report quickly with transaction IDs. Our guide to swapping without connecting a wallet explains why address-only flows reduce the attack surface.
Final thoughts
Ngrave’s hardware wasn’t broken and its app code wasn’t modified. A notification key was enough. In 2026, the weakest link in self-custody is rarely the chip — it’s every system that can talk to you in the wallet’s name.