Crypto thieves hijacked the alert and notification system used by Belgian hardware-wallet maker Ngrave and sent fake security warnings to its users, then drained roughly $2.56 million from people who followed the bogus instructions. The breach didn't touch the hardware wallets themselves. It went through the trusted channel users rely on for genuine warnings, which is a harder thing to defend against than a firmware flaw.
How the fake alerts worked
Ngrave's notification system is the part of the operation that talks to customers — the channel that carries security advisories and account notices. Attackers got into it and used it to broadcast warnings that looked like they came from Ngrave. The alerts pushed users toward whoever was behind them, and those users lost about $2.56 million in total. The facts here don't say what the messages told people to do, or how many customers were hit. What's clear is the mechanism: the warning itself was the weapon.
The wallet wasn't the weak point
This is the part worth sitting with. Hardware wallets are built on the premise that the private keys stay offline and the device is the last line of defense. That held up — the attackers didn't compromise the wallet. They compromised the relationship between the company and its users, and that was enough. A message that appears to come from the maker of your wallet carries a lot of weight. Users are trained to trust it, and the people behind this scam knew it.
It's the same pattern that keeps showing up across crypto: the code holds, the humans get played. Phishing through official-looking channels has taken more money than most exploits, and it doesn't require breaking any cryptography. Ngrave now joins the list of firms whose own communications were turned against their customers.
What Ngrave hasn't said
As of this writing, the facts don't include a statement from Ngrave, a timeline for when the hijack happened or how long it ran, or any detail on whether the company has locked down the notification system. There's no word on whether law enforcement in Belgium or anywhere else is involved, and no confirmed figure on how many users received the fake alerts. Those gaps matter — they're the difference between a contained incident and one that's still unfolding.
The $2.56 million figure is the only hard number attached to the losses so far. Whether that's the final tally or an early estimate isn't clear.
The question every wallet user should ask
If a security warning lands in your inbox or on your phone and it says it's from your wallet provider, how do you check it's real? Most people can't, at least not quickly. That's the gap the attackers found. Ngrave's users did what they were told by a channel they had reason to trust, and it cost them millions. The next concrete step is finding out what Ngrave does to restore confidence in that channel — and whether the company says anything at all about how the breach happened.
