NGRAVE Traces $2.56M Theft After Fake LIQUID Security Alerts
By Crypto Wire
October 22, 2026
NGRAVE’s October 19, 2026 incident report says attackers hijacked a third-party push-notification provider for the LIQUID companion app on the evening of October 17, sending a fake “portfolio synced on a new device — Pixel 9, Moscow” alert that led to a cloned site asking for a recovery phrase or Perfect Key. NGRAVE’s minimum trace: about $2.56 million from roughly 70 addresses on Bitcoin, XRP, Ethereum, and Stellar (17 Oct prices). Bitquery separately estimates about $2.65 million from 84 wallets across six chains in ~six hours — and notes the public record cannot prove every emptied wallet belonged to an NGRAVE user. This is a Rug Room chapter: notification-provider phishing, not a ZERO hardware-key breach.
Exploit path, per NGRAVE: attacker held notification-provider access from as early as 11 October; fake alert ~21:30 UTC 17 Oct; first wallet emptied 21:36; first key cut 21:40 but a second key kept alerts flowing until all notification sending stopped at 22:45; last traced theft 03:51 UTC 18 Oct. ZERO private keys never left the device — only phrases/Perfect Keys typed into the fake site. Fund trail (NGRAVE): BTC ~$1.77M split across 12 addresses; XRP ~$454k into ChangeNOW (54 deposits); ETH side sold to ~130.47 ETH via LI.FI; Stellar ~$18k to a likely exchange deposit. Bitquery’s cut puts much of the loot into Hyperliquid accounts as XMR1 (~$2.16M still parked as of its 19 Oct morning snapshot).
Remediation watch: NGRAVE shut notifications, replaced live keys, is asking exchanges/bridges to freeze, and pledges LIQUID will only open official NGRAVE links plus dual-approval for messages. Keep separate from Railway env-var drains and Qubic weak-seed chapters — different vector (push-provider hijack → seed phishing vs server secrets or weak seeds).
For security desks, the cut is vendor-path risk: a trusted push channel can phish the seed even when the cold device itself stays sealed.
What to watch on-chain next: Watch ChangeNOW freeze outcomes on the XRP cluster, whether Bitquery’s Hyperliquid XMR1 pile moves or cashes out, and NGRAVE’s next dated update if the $2.56M minimum rises as more networks are matched.
Bottom line: Fake LIQUID push alerts phished seeds — NGRAVE’s minimum ~$2.56M / Bitquery ~$2.65M; ZERO keys were not extracted from the device.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The cryptocurrency and NFT markets are highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
