NGRAVE Phishing Attack Drains $2.56 Million From About 70 Wallets

NGRAVE disclosed that a phishing campaign tied to its LIQUID companion app drained about $2.56 million from roughly 70 wallet addresses across four blockchains after attackers sent users fake security alerts.

The attackers hijacked a third-party notification service used by LIQUID and sent the alerts on Saturday, Oct. 17. The messages directed recipients to imitation websites that asked for a 24-word recovery phrase or a Perfect Key. Automated scripts then moved funds within minutes.

Bitcoin (BTC) accounted for about $1.77 million in losses. XRP losses totaled about $454,000, Ether (ETH) assets about $316,000 and Stellar about $18,000.

Unauthorized access may have started Oct. 11. NGRAVE detected the fake notification about one minute after it went out, but the first wallet was emptied about six minutes later. The company shut down the notification system that evening.

NGRAVE said its ZERO hardware wallet and private keys were not directly compromised; affected users entered their credentials on phishing sites. The company replaced affected keys and added two-person approval, domain restrictions and an emergency shutdown mechanism. It advised affected users to create new wallets and contact support. Device information, wallet activity, IP addresses and approximate locations may also have been exposed.