A fake NGRAVE security alert stole wallet secrets: what owners need to check
Source report: 2026-10-19 · Editorial analysis published: 2026-10-21
NGRAVE’s October 19 report describes how attackers used real app notifications to send people to a fake recovery page. The practical lesson matters for wallets receiving mining payouts.
An alert that arrived through the real channel
A warning on your phone says someone has connected to your crypto wallet. It looks familiar, arrives through an app you actually use and urges you to stop the intruder. That was the trap described by hardware-wallet maker NGRAVE in its October 19 incident report about the attack on October 17. For anyone receiving mining payouts, it is a reminder that protecting coins also means protecting the backup that can restore access to them.
According to the company, attackers gained access to a third-party service used to send LIQUID notifications. They sent a false warning and directed users to a copy of the company website. The page asked for a 24-word recovery phrase or the NGRAVE Perfect Key. Entering either secret gave the attackers the means to move the money. The report says the ZERO hardware and LIQUID application code were not breached; this is the manufacturer’s account of an investigation that remains ongoing.
Why an offline device did not stop this trick
A recovery phrase is a backup from which compatible wallet software can restore the keys controlling a wallet. Think of it as a master key, rather than a password for reading a balance. A public receiving address can be shared so somebody can pay you. A recovery secret has the opposite role: it must stay private. The Perfect Key is also secret recovery material in NGRAVE’s system, not a support reference number.
A hardware wallet is designed to keep signing keys away from an ordinary connected computer. That protection cannot make a disclosed recovery backup secret again. If someone restores the same wallet using stolen recovery material, they do not need to borrow the original device. This explains the attack mechanism without suggesting that every hardware wallet has the same technical fault. The decisive question in this incident is what was typed into the fake page, not simply whether the owner had bought an offline device.
The important difference is between restoring access and simply signing in: a familiar-looking web login does not make a request for the recovery backup appropriate.
What the company tells affected people to do
NGRAVE says anyone who entered the recovery phrase or Perfect Key should treat that wallet as unsafe across its networks, including when only part was entered or the page claimed the phrase was wrong. Its advice is to create a new wallet with a new recovery phrase, move remaining assets and stop sending money to the old addresses. Merely reinstalling the app or changing a login password does not replace a recovery secret already disclosed to somebody else.
For people who only opened the link or pressed a button, the company says this particular site stole information entered into it, rather than taking money just from a click. That distinction helps owners assess what happened; it is not a general promise that unfamiliar links are harmless. The report also identifies a fake home-screen web app called NGRAVE Security Center and asks users to remove it. Help should be sought through the independently opened official site, not through another urgent message arriving after the incident.
The loss estimate is still a minimum
The manufacturer reports tracing about US$2.56 million from roughly 70 wallet addresses on four networks, using October 17 prices. It calls that a minimum while more reports and networks are checked. Addresses are not the same thing as individual people, and a traced dollar amount is not a recovered amount. The report says exchanges and other services have been asked to freeze funds; it does not establish that these requests have returned the money.
There is also a privacy issue. NGRAVE says some accessible app data could connect wallet addresses and balances with an IP address and approximate location for users who opened LIQUID around the attack. That could make a follow-up scam sound unusually convincing. A message knowing a wallet balance is still not entitled to its recovery secret. The company warns against paid recovery offers and says it will never ask for the phrase or Perfect Key, including during support.
What this means for mining payouts
A mining pool needs an appropriate receiving address to send a payout; it does not need the wallet’s master recovery secret. These two pieces of information serve completely different purposes. If a compromised wallet is also receiving recurring mining income, leaving its old address in payout settings can send fresh coins into the same danger. Follow the pool’s official process to update an address after establishing the new wallet, and check any payment hold or confirmation that the pool applies.
That is a practical consequence of the reported attack, not evidence that a mining pool was breached. An ASIC continuing to submit work says nothing about whether the destination wallet remains safe. Keep the device, pool account and payout destination as three separate checks. When moving to a new destination, verify the intended receiving address through the wallet’s own trusted process; never paste a recovery phrase into a pool page, a chat or an online verification form.
The changes to watch next
NGRAVE says it stopped notifications, replaced production access keys and reported the incident. Its next measures include restricting links opened from the app, reducing the permissions of notification keys and requiring two people to approve messages. Those are announced changes to follow, not a reason to assume every safeguard was already operating when the report appeared. An access key for sending a message should not also provide broad access to unrelated customer information.
The immediate rule for an owner is easier to remember than a security checklist: a warning can come through a familiar channel and still ask for the wrong thing. Pause at any request for recovery material. Open the manufacturer’s official source yourself and establish what actually happened before responding. If a secret was disclosed, use the manufacturer’s incident instructions and a newly generated wallet rather than waiting for another reassuring notification. A genuine support conversation does not require handing over the master key.
Source: NGRAVE ↗
Mining calculator ↗
