NGRAVE Traces Stolen Bitcoin to 12 Addresses After Wallet Phishing

NGRAVE has traced stolen Bitcoin (BTC) into 12 addresses after fake LIQUID security alerts led wallet users to disclose recovery credentials, adding detail to a theft estimated at $2.56 million.

Bitcoin accounted for about $1.77 million of the traced losses. Another $454,000 in XRP moved through 54 transfers, while losses in Ethereum-based assets totaled about $316,000. The estimate covers roughly 70 wallet addresses at Oct. 17 prices. NGRAVE is still checking other networks and customer reports.

The transaction details extend the earlier account of the $2.56 million theft. LIQUID is the companion app for NGRAVE’s ZERO hardware wallet.

The attackers gained access to an outside provider used to send LIQUID notifications. At about 5:30 p.m. ET (21:30 UTC) on Oct. 17, they sent a false alert claiming a user’s portfolio had been synced to a Pixel 9 in Moscow. The alert led to a counterfeit NGRAVE site that requested a 24-word recovery phrase or Perfect Key. Either credential could be used to restore a wallet and transfer its holdings without the ZERO device.

NGRAVE detected the alert within about a minute, but the first wallet was emptied roughly six minutes after it appeared. NGRAVE shut off its notification system by 6:45 p.m. ET (22:45 UTC). Its ZERO hardware wallets, stored private keys and LIQUID code were not breached.

NGRAVE has replaced the affected access keys and plans tighter controls on notifications.