Wallet maker NGRAVE says fake app alert led to at least $2.56 million in crypto thefts
Attackers used a third-party notification provider to send LIQUID app users a fake security alert linking to a copycat site that asked for recovery phrases, NGRAVE said.
Belgian hardware wallet maker NGRAVE says it has traced at least US$2.56 million stolen from about 70 wallet addresses on four networks after attackers sent users of its LIQUID app a fake security alert.
In an incident report, NGRAVE said attackers took over the access of a third-party provider that sends LIQUID’s push notifications. At about 9:30pm GMT on 17 October, users received a message saying their portfolio had been synced on a new device, a “Pixel 9, Moscow”. It led to a copy of NGRAVE’s website that asked for a 24-word recovery phrase or the company’s “Perfect Key” backup. Wallets of people who entered either were emptied within minutes, the company said.
NGRAVE said its ZERO hardware wallets, the private keys stored on them and LIQUID’s app code were not breached. It said it shut down all notifications at 10:45pm GMT, replaced every key used by its live systems, reported the incident to authorities and asked exchanges and bridge services to freeze funds. It also said the attacker could read some app data, including swap history and device details, and that it is reporting this to the Belgian Data Protection Authority.
The company said its tally, at 17 October prices, is a minimum. TokenPost reported that a broader on-chain count reached US$2.65 million across 84 wallets on six networks, though transaction records cannot show that every wallet belonged to an NGRAVE user.
NGRAVE said LIQUID will in future only open links to the company’s own official sources.
See also: Crypto hacks cost $1.18 billion in third quarter, security firm Hacken says.
Sources
Related coverage
All crypto →
Crypto hacks cost $1.18 billion in third quarter, security firm Hacken says
Hacken counted 107 incidents from July to September, with losses up 55% from the previous quarter. It said most of the money was lost through suppliers, unapplied fixes or systems outside audits.
Qubic halts its network and Cysic suspends its bridge after weekend exploits
Qubic said 1,404 wallets were drained of about 2.94 trillion QU tokens. Cysic said 10 million CYS tokens were minted without authorisation through its bridge.
Google quantum chip result revives debate over risk to older bitcoin wallets
Google says its Willow chip cut errors in a key quantum computing step about 40-fold. Crypto researchers disagree on what that means for when bitcoin's cryptography could be at risk.
California regulator and six blockchain groups file objections to SEC crypto offering proposal; SEC keeps taking comments
California's financial regulator said the SEC's 'Regulation Crypto Assets' plan would override state investor protections, while Chainlink Labs, the Cardano Foundation and four others asked for digital commodities to be written into the rule.
