[NGRAVE Suffers Phishing Attack, Approximately 70 Wallets Stolen for $2.56 Million] Odaily Planet Daily News: Digital hardware wallet manufacturer NGRAVE disclosed on October 19 that attackers hijacked the third-party notification service used by its LIQUID companion app and sent fake security alerts to users, resulting in approximately 70 wallet addresses being stolen across four blockchains, with a total loss of about $2.56 million. Among the stolen assets, Bitcoin accounted for approximately $1.77 million, XRP for about $454,000, Ethereum assets for around $316,000, and Stellar for roughly $18,000. The attackers tricked users into clicking on a phishing website and entering their 24-word recovery phrase or Perfect Key, then used automated scripts to transfer the assets within minutes. NGRAVE stated that the ZERO hardware wallet and private keys were not directly compromised; victims voluntarily provided recovery credentials during the phishing process. Unauthorized access may have begun on October 11. After obtaining one access key, the attackers acquired a broader access key and sent fake notifications on October 17. NGRAVE detected the anomaly approximately one minute after the notifications were sent, but the first wallet was emptied within six minutes. The notification system was shut down later that evening. NGRAVE's CEO admitted that the company failed to fulfill the most basic security responsibilities expected of a crypto security enterprise. He stated that the affected keys have been replaced, and new measures such as dual-approval processes, domain restrictions, and emergency shutdown mechanisms have been implemented. The company also advised affected users to create new wallets and contact the support team, as some device information, wallet activity, IP addresses, and approximate locations may have been exposed. (Bitcoin.com News)