NGRAVE ZERO Hacked? What Really Happened in the October 17 Phishing Attack
Was the NGRAVE ZERO hacked? No — and that distinction is the whole story.
On October 17, attackers hijacked a third-party notification service used by NGRAVE's LIQUID companion app. Fraudulent security alerts directed users to a counterfeit website requesting their recovery phrase or NGRAVE Perfect Key.
NGRAVE reported that the ZERO hardware device and its stored private keys were not directly breached.
The fake alert claimed a user's portfolio had been synced on a new device, a Pixel 9 in Moscow. Some users also saw a "Security notice" banner inside the app. Both led to a lookalike "Security Center" page that asked for the 24-word recovery phrase or Perfect Key backup.
That is the crucial difference between a device hack and a phishing attack. The attackers did not break into the ZERO.
They broke trust in a message channel, then persuaded people to give up the one thing that can rebuild a wallet anywhere: the recovery credentials.
Once those were entered, automated scripts recreated the wallets and emptied them within minutes.
NGRAVE said in its October 19 incident report that it had traced approximately $2.56 million taken from about 70 wallet addresses across four networks. The company broke that total down into roughly $1.77 million in Bitcoin, $454,000 in XRP, $316,000 in Ethereum assets and $18,000 in Stellar.
NGRAVE described the figure as a minimum while it continues examining affected accounts.
The timeline shows how fast this kind of attack moves. NGRAVE's team spotted the alert at 21:31 UTC, while the first wallet was emptied at 21:36 UTC.
The company cut off the first stolen key at 21:40 UTC, but alerts continued through a second key until it shut down all notification sending at 22:45 UTC.
What makes the ZERO different, even in this incident, is its design. The device is completely air-gapped: no USB, Bluetooth, NFC, or WiFi for signing.
All transaction signing happens through QR codes: the phone app generates a QR code, the ZERO scans it offline, signs it, and displays the resulting QR code for the phone to broadcast. The private key never comes into contact with the network.
If you only tapped the link and typed nothing, NGRAVE says you are safe. If you entered your seed or Perfect Key, treat that wallet as compromised: move funds to a new wallet with a fresh seed and contact NGRAVE support through ngrave.io typed manually, not through a link in a message.
Researching the ZERO for yourself:
Learn more about NGRAVE ZERO
