NGRAVE ZERO Hack Warning: How a Hijacked LIQUID Notification Stole Crypto — And Why Cold Storage Still Matters
This is the warning every hardware wallet owner needs to hear, even if you don't own a NGRAVE: a real-looking alert is not proof it's real. The request itself is the red flag.
On October 27, ten days after the phishing campaign, NGRAVE warned users that it is facing high-level cyber threats and impersonation attempts.
The company said its ZERO hardware wallet was not compromised and that losses came from users who typed their wallet recovery credentials into a fake website.
NGRAVE's rule, repeated since the attack, is simple: it will never ask for a recovery phrase or Perfect Key through any channel, except when a user restores a wallet by typing the phrase directly on the ZERO's own screen.
If you get a security alert from *any* wallet company, stop and check these three things:
- Does it ask for your 24 words or Perfect Key on a website, in an app, by email, or in a chat? If yes, it's a scam. No legitimate wallet vendor will ever ask for that.
- Does it create panic with a countdown, a new device in another country, or a threat that your funds will be lost if you don't act now? That's social engineering, not security.
- Did you click a link to get there? Type ngrave.io into your browser manually or use a saved bookmark instead.
NGRAVE named its verified X account and support@ngrave.io as its only official channels.
What to do if you were caught:
If you entered your phrase or Perfect Key, assume that wallet is compromised across networks, move any remaining assets to a brand-new wallet with a new recovery phrase, contact NGRAVE support, file a police report, and ignore anyone offering to recover stolen crypto for a fee — that's often a second scam.
What to do if you didn't enter anything:
You should be safe from this specific attack, but use it as a wake-up call. Review your backup plan. Is your recovery phrase stored safely offline?
Do you have a durable backup like GRAPHENE, not just paper that can burn, fade, or get lost? Do you know exactly how you would restore if your device was lost or damaged?
That's why the ZERO still makes sense for long-term holders. The LIQUID app is a companion for viewing and preparing transactions, but the keys stay on the air-gapped device.
The ZERO is fully offline: no USB data transfer, no Bluetooth, no Wi-Fi, no NFC, no 4G. Transaction signing happens on-device and is communicated via QR codes, keeping private keys isolated from any networked environment.
In other words, the October attack proved the opposite of what the scariest headlines suggest.
It proved why you don't want your keys on an internet-connected device, and why you never, ever hand your backup to a website — no matter how official the alert looks.
Researching the ZERO for yourself:
Learn more about NGRAVE ZERO
I'm an independent publisher and affiliate, not NGRAVE, not a security auditor, and not guaranteeing any product will prevent losses. The link above is my affiliate link, with no extra cost to buyers. Shop at your own risk and do your own research.
