Ngrave Says $2.56M Left 70 Wallets After Faked App Alerts

Fake security alerts went out through Ngrave's companion app at 21:30 UTC on 17 October. The Belgian hardware wallet maker says it spotted them inside a minute. Six minutes after the first alert, the first wallet was empty. Ngrave's incident report, published on 19 October, puts the loss at $2.56 million taken from 70 addresses, and says the ZERO devices it sells and the private keys held on them were never touched. Victims typed their own recovery words into a copy of the company's website.

Six hours, then it stopped

The sequence is tightly dated for an incident of this kind. Unauthorised access may have begun on 11 October, six days before any alert went out. Ngrave shut its notification system down at about 22:45 UTC on the 17th. Thefts from wallets already compromised carried on until 03:51 UTC the next morning, which is the six-hour window CryptoSlate and AMBCrypto describe. The alert claimed a portfolio had synced with a new Pixel 9 handset. Tapping it opened a counterfeit Ngrave page with a countdown and a deny button, and denying the sync led to a prompt for the 24-word recovery phrase or a Perfect Key, Ngrave's name for the credential that restores a wallet.

Two tallies, and they do not match

Ngrave's $2.56 million sits on four chains: about $1.77 million in bitcoin, $454,000 in XRP, $316,000 in Ethereum-based assets and $18,000 in Stellar. Bitquery, an analytics firm whose tracing CryptoSlate carried on 20 October, counts about $2.65 million across 84 wallets and names six chains, adding solana and dogecoin. It puts the bitcoin share at roughly $1.76 million drained from 21 wallets. The gap is $10,000 wide and nobody explains it. The two counts do not reconcile. CryptoSlate offers one partial reason for the wallet spread, that other phishing campaigns may account for some of the 84, and neither Ngrave nor Bitquery addresses the other's number.

Where the coins went

The routes converge. Bitcoin moved through Chainflip, which Bitquery counts as 12 swaps; Bitcoin.com News, writing the same day, describes the bitcoin as split across 12 addresses instead. The number matches and the thing it counts does not. Ethereum and solana went over bridges, with LI.FI and Mayan in the path on AMBCrypto's reading. All of it arrived at 39 newly created accounts on Hyperliquid, a perpetual futures venue, which bought 3,592.71 XMR1 for about $2.16 million. XMR1 is a token that tracks the monero price. At Bitquery's 09:00 UTC check on 19 October the holding was worth about $2.12 million and had been neither sold nor withdrawn. Where the XRP, Stellar and dogecoin went is not established in anything read here.

One key opened the second

What the attackers broke into was a third-party service that delivers Ngrave's push notifications, not Ngrave's own systems. They obtained one access credential, then used it to get a second with broader privileges, including some access to analytics. That is why the exposure runs past the coins. Ngrave says device information, wallet activity, IP addresses and approximate locations may have been seen, which is material for targeted scams later. The compromised keys have been rotated, and the company has added two-person approval for sensitive operations, domain restrictions and an emergency shutdown. Affected users are told to create fresh wallets.

"In my humble opinion, the first duty of a crypto security company is to provide exactly that: security," Ngrave's chief executive said in the incident report. "In this, we have absolutely and utterly failed."

Ngrave is not the only one this month. A near-identical campaign hit SecuX users on 16 October, the day before, and Kraken's chief security officer called Ngrave the second wallet maker in two days whose app notifications were used to steal recovery phrases, in a post carried by CryptoSlate alone. Coldcard said on 11 October that a phishing link had gone out from its own X account, and in September phishing mail reached Trezor users from Trezor's own domain after a breach at an email provider. Each time the channel the wallet maker owns is the one carrying the lure. Ngrave's investigation is still running, and no account read here names who sent the alerts.