A sophisticated cyber attack exploited NGRAVE's security infrastructure to steal ₹21.6 crore ($2.56 million) worth of cryptocurrency from users' wallets. According to reports from AMBCrypto, the breach occurred through fake security alerts sent via the LIQUID app, which is designed to work alongside NGRAVE's ZERO hardware wallet. The attackers gained unauthorized access to NGRAVE's third-party notification system and used this access to distribute fraudulent messages on January 17th.
The fraudulent alerts appeared legitimate, informing users that their portfolio had been synced with a new device. As reported by AMBCrypto, users who clicked the alert were redirected to a fake version of NGRAVE's website displaying a countdown timer and options to deny the sync. The denial process led to a page requesting recovery credentials, which users unwittingly provided, believing they were securing their accounts. The first wallet was emptied at approximately 21:36 UTC on January 17th, with the last theft tracked occurring the following day.
The attack targeted 70 wallet addresses across four networks, with Bitcoin representing the largest loss followed by Ethereum. According to AMBCrypto's incident report, the stolen funds were routed through various channels including Chainflip for Bitcoin swaps to Ethereum, and Solana conversions to USDC before bridging to other networks. The majority of funds passed through LI.FI and Mayan before reaching Hyperliquid, where 39 newly created accounts purchased 3,592.71 XMR1 tokens worth approximately ₹17.8 crore ($2.16 million).
NGRAVE temporarily disabled notifications while investigating the breach and restored LIQUID service once the problem was resolved. As reported by AMBCrypto, the company has not disclosed the specific third-party company responsible for the notification system that was compromised. The attack represents a significant security incident for the hardware wallet industry, demonstrating that even offline storage solutions can be vulnerable to sophisticated phishing attacks targeting associated mobile applications.
