Fake NGRAVE security alerts lead to $2.56M crypto theft in six hours
The message claimed their portfolio had synced with a new device.
Hardware wallets were supposed to be the safe option. This week, some NGRAVE users found out the hard way that a fake message can still get you.
What actually happened?
Fake LIQUID app alerts drained NGRAVE wallets of $2.56 million in over six hours
LIQUID is the phone app that works alongside NGRAVE’s ZERO hardware wallet. In an incident report, NGRAVE said attackers had gained access tied to a third-party company that handles its app notifications. On the 17th, they used that access to push out fake security alerts.
The alert told users their portfolio had been synced with a new device, which would make most people assume someone else had gotten into their account.
Source: ngrave.io
Anyone who tapped it landed on a copy of NGRAVE’s site. It showed a countdown timer and an option to deny the sync. Choosing to deny led to a page asking for recovery credentials, so handing them over felt like part of locking the account down.
The first wallet was emptied at around 21:36 UTC on the 17th, and the last theft it tracked happened the next day.
NGRAVE turned off notifications while it looked into the breach. LIQUID was back online once the problem was fixed.
NGRAVE crypto wallet scam: How much is gone?
Attackers took almost $2.56 million, spread across 70 wallet addresses in four networks.
Bitcoin [BTC] was the biggest loss, followed by Ethereum [ETH].
The stolen funds took different routes. Bitcoin was sent through Chainflip and mostly swapped for ETH. Solana was converted to USDC and bridged to other networks. Much of it passed through LI.FI and Mayan before ending up on Hyperliquid.
There, 39 newly created accounts used it to buy 3,592.71 XMR1, a token that tracks Monero’s price.
The spend was about $2.16 million in total.
Where the XRP, Stellar and Dogecoin went is still a mystery.
Final Summary
- Fake alerts in NGRAVE’s LIQUID app tricked users into giving up recovery credentials.
- NGRAVE says at least $2.56 million was stolen.
