Security Breach: NGRAVE App Exploited in $2.1 Million Phishing Scheme
The cryptocurrency world is reeling after a sophisticated phishing campaign successfully hijacked the notification system of NGRAVE’s LIQUID companion app, leading to the theft of approximately $2.65 million. By leveraging trusted communication channels, attackers managed to bypass traditional security perceptions, funneling over $2.1 million in stolen assets into the Hyperliquid platform. This incident highlights a growing trend of targeting the software ecosystems surrounding hardware wallets rather than the devices themselves.
The Mechanics of the Notification Hijack
On October 17, attackers compromised a third-party service responsible for delivering push notifications for NGRAVE’s LIQUID app. Victims received alarming, legitimate-looking alerts claiming their portfolios had been synchronized with a new device in Moscow. Driven by urgency, users were directed to a fraudulent website that prompted them to enter their recovery phrases or "Perfect Keys." Because these credentials allow for the total reconstruction of a wallet, the attackers were able to drain assets across multiple blockchains—including Bitcoin, Ethereum, and Solana—without ever needing physical access to the NGRAVE ZERO hardware devices.
Strategic Laundering and the Rising Threat to Hardware Wallets
Following the theft, blockchain analytics firm Bitquery traced the movement of the illicit funds as they were moved through various bridges and swaps. The attackers eventually concentrated the proceeds into 39 Hyperliquid accounts to purchase XMR1, a token designed to track the privacy-centric cryptocurrency Monero. This breach is not an isolated event; it follows a nearly identical attack on SecuX and recent vulnerabilities identified in other major manufacturers like Coldcard and Ledger. As hardware manufacturers continue to harden their physical devices, cybercriminals are increasingly shifting their focus toward third-party infrastructure and the human element, exploiting the very trust users place in official mobile applications.
