Belgian hardware wallet maker Ngrave says thieves stole approximately $2.56 million from its customers after hijacking a third-party system used to send security alerts through the company's mobile application. The company disclosed the breach on Oct. 19 in an official incident report.

According to the disclosure, attackers gained control of a notification provider used by Ngrave's LIQUID companion app. On Oct. 17, they exploited that access to push fake security warnings directly to users' devices through the same channel the app uses for its legitimate alerts.

The message claimed that a user's portfolio had been synced with a Pixel 9 device in Moscow. Tapping the alert opened a counterfeit Ngrave website displaying a countdown timer and presenting two buttons: one to approve the activity and one to deny it. Both buttons led to the same trap. Users who proceeded were asked to enter their 24-word recovery phrase or their Perfect Key, either of which gave the attackers full access to their wallets. A recovery phrase exists to restore a wallet on a new device and should never be entered on any website — a rule the counterfeit page was built to make users break. Automated scripts then emptied the affected accounts within minutes.

Ngrave traced the losses to 70 wallet addresses across four blockchain networks. Bitcoin made up the largest share of the stolen funds at $1.77 million. Thieves also took $454,000 in XRP, $316,000 in Ethereum-based assets and $18,000 in Stellar.

How the Attack Unfolded

Ngrave's incident report says unauthorized access may have begun on Oct. 11, six days before the fake alerts went out. Investigators believe the attackers obtained one access key and used it to acquire a second key with wider permissions, including access to some analytics data.

The company says it spotted the fraudulent alerts within a minute of their appearance at 9:30 p.m. UTC on Oct. 17. Even so, the first wallet was drained six minutes later. Ngrave shut off its notification system by 10:45 p.m. Thefts from wallets that had already been compromised continued until 3:51 a.m. the next morning.

The company maintains that its ZERO hardware wallets and the private keys stored on them were never breached. Rather than defeating the devices themselves, the attackers tricked customers into voluntarily surrendering their own recovery details.

The stolen funds moved through exchanges, blockchain bridges and newly created addresses. Ngrave traced the bitcoin into 12 addresses, while the XRP was moved through 54 transfers. Blockchain analytics firm Bitquery said in its own report that "most of it now sits on Hyperliquid as a Monero token," estimating that roughly 81% of the funds ended up on the decentralized perpetuals exchange.

CEO Admits Failure

Ngrave's chief executive delivered an unusually direct statement in the incident report. "In my humble opinion, the first duty of a crypto security company is to provide exactly that: security. In this, we have absolutely and utterly failed," he said.

He acknowledged that the company's security was not strong enough when he took over as leader months earlier. Ngrave also disclosed that device information, wallet activity, IP addresses and approximate locations may have been exposed in the incident.

The breach adds to a difficult year for hardware wallet makers. Nearly a dozen security incidents in 2026 have involved brands such as Ledger, Trezor, Tangem, Safepal, Bitbox02 and Coldcard, with reported losses topping $180 million across two incidents.

Ngrave has replaced the compromised access keys and plans tighter controls over its notification infrastructure. Planned measures include two-person approvals for alerts, restrictions on sending domains and an emergency shutdown option. The report does not, however, explain how the attackers obtained the first access key, and the new safeguards remain at the planning stage. The company is urging affected customers to set up new wallets and contact its support team. The investigation remains ongoing.

This article draws on Ngrave's official incident report and Blockonomi's original coverage.