Hardware wallets were supposed to be the safe option. This week, some NGRAVE users found out the hard way that a fake message can still get you.
LIQUID is the phone app that works alongside NGRAVE’s ZERO hardware wallet. In an incident report, NGRAVE said attackers had gained access tied to a third-party company that handles its app notifications. On the 17th , they used that access to push out fake security alerts.
The alert told users their portfolio had been synced with a new device, which would make most people assume someone else had gotten into their account.
Anyone who tapped it landed on a copy of NGRAVE’s site. It showed a countdown timer and an option to deny the sync. Choosing to deny led to a page asking for recovery credentials, so handing them over felt like part of locking the account down.
The first wallet was emptied at around 21:36 UTC on the 17th, and the last theft it tracked happened the next day.
NGRAVE turned off notifications while it looked into the breach. LIQUID was back online once the problem was fixed.
Attackers took almost $2.56 million , spread across 70 wallet addresses in four networks.
Bitcoin [BTC] was the biggest loss, followed by Ethereum [ETH].
The stolen funds took different routes. Bitcoin was sent through Chainflip and mostly swapped for ETH. Solana was converted to USDC and bridged to other networks. Much of it passed through LI.FI and Mayan before ending up on Hyperliquid.
There, 39 newly created accounts used it to buy 3,592.71 XMR1 , a token that tracks Monero’s price.
Where the XRP, Stellar and Dogecoin went is still a mystery.