Significant Breach of Trust
In a significant breach of trust, a fake security alert directed at crypto wallet users led to the theft of approximately $2.56 million. On October 17, victims were misled into believing there was suspicious activity involving their accounts—prompting many to react quickly in an effort to safeguard their investments. However, this urgency played right into the hands of criminals who successfully exploited a vulnerability within a trusted notification system, without compromising the hardware itself.
Details of the Incident
Ngrave, a Belgian firm specializing in hardware wallets, reported this alarming incident on October 19. The company revealed that their LIQUID companion app was targeted when attackers infiltrated a third-party notification provider. The malicious message indicated that a user’s portfolio had been synchronized with a Pixel 9 device located in Moscow. Users who engaged with this fake alert were directed to a fraudulent Ngrave site, which featured a countdown timer and misleading options to approve or deny the supposed suspicious activity. Unfortunately, selecting either option left users vulnerable, as they were coerced into providing their 24-word recovery phrase or Perfect Key—essentially granting the attackers the details needed to seize control of their wallets.
Investigation and Recovery
Ngrave conducted a detailed investigation resulting in the recovery of about 70 compromised wallet addresses spanning across four different networks. The investigation uncovered that Bitcoin accounted for the majority of the loot, with $1.77 million stolen; XRP losses totaled $454,000, followed by Ethereum-based assets at $316,000 and Stellar assets amounting to $18,000.
Timeline of Events
The breach was traced back to unauthorized access that likely began on October 11, a full six days before the fraudulent notifications were dispatched. Attackers cleverly obtained one access key and managed to acquire another with expanded permissions, gaining access to certain analytics data. Although Ngrave recognized the malicious alerts almost immediately—within a minute of their initiation at 9:30 p.m. UTC—the first wallet was already drained by 9:36 p.m. Ngrave quickly deactivated its notification system by 10:45 p.m. Nevertheless, funds continued to be siphoned from compromised wallets until hours later, around 3:51 a.m. the next morning.
Security Assurance and Future Measures
Importantly, Ngrave has assured users that their ZERO hardware wallets and underlying private keys remained untouched; the scams mainly relied on tricking customers into divulging their own critical information. Following the attacks, stolen assets went through various exchanges and blockchain bridges, including the notorious Hyperliquid platform where many funds were converted into Monero tokens, with Bitquery reporting that approximately 81% of the stolen amount circulated through the DEX exchange.
Company Response
Ngrave’s CEO openly acknowledged the company’s failure to uphold its promise of security. He admitted that the organization’s defenses were lacking when he took over a few months prior. Consequently, Ngrave has undertaken measures to enhance its security protocols, which now include two-person approval processes, restricted domains, and improved emergency shutdown functionalities. The company is advising affected users to create new wallets and reach out for assistance while the investigation unfolds.
Industry Implications
This incident is part of a troubling trend, as hardware wallet manufacturers have faced numerous security challenges throughout the year, raising serious concerns within the industry. With infringements reported from major players like Ledger and Trezor, the total losses have surpassed $180 million, underscoring vulnerabilities associated with firmware, external vendors, and potential phishing attempts rather than direct attacks on recovery credentials.
