Ngrave Says ZERO Wallets and Private Keys Were Not Compromised
The Ngrave security incident continued after the company disabled its notification system by 10:45 p.m. Thefts from previously compromised wallets remained active until 3:51 a.m. the following morning, according to the company’s account of the incident. Despite the continuing outflow of funds, Ngrave maintains that its ZERO hardware wallets and the associated private keys remained untouched.
That distinction is central to Ngrave’s response. Rather than reporting a direct compromise of the hardware itself, the company said criminals manipulated customers into surrendering their own credentials. In practical terms, the trusted communication and support processes surrounding the wallets became the mechanism through which victims were targeted.
Stolen Cryptocurrency Traced Through Exchanges, Bridges and New Addresses
The stolen funds moved through a combination of cryptocurrency exchanges, blockchain bridges and fresh wallet addresses. Ngrave traced the bitcoin associated with the incident into 12 addresses, while $XRP moved through 54 transfers. The routes show how the assets were dispersed through several parts of the digital-asset infrastructure rather than remaining in the wallets from which they were taken.
Ngrave also acknowledged the potential exposure of device information, wallet activity, IP addresses and customers’ approximate locations. Although the ZERO devices and private keys are said to have remained secure, the possible disclosure of operational and user data could give criminals material for follow-up, targeted scams.
Ngrave CEO Admits Company ‘Absolutely and Utterly Failed’
“In my humble opinion, the first duty of a crypto security company is to provide exactly that: security. In this, we have absolutely and utterly failed.”
The Ngrave CEO also acknowledged that the company’s security posture was inadequate when he assumed leadership several months earlier. His unusually direct assessment accompanied a list of corrective measures that includes the replacement of compromised keys and tighter controls over notifications.
Under the revised system, two-person approvals are required for sensitive actions, while restricted domains and emergency shutdown capabilities have been added. Affected customers are being urged to establish fresh wallets and contact Ngrave support. The investigation remains active, leaving the company to demonstrate whether the new controls can address the trust-based attack that preceded the losses.
Bitquery Finds Most Stolen Funds on Hyperliquid
Analytics firm Bitquery separately examined the movement of the stolen assets. In its report, Bitquery noted that, in terms of the stolen funds, “most of it now sits on Hyperliquid as a Monero token.” The company estimated that around 81% of the funds found their way to the popular perps DEX exchange.
Bitquery’s analysis places a large majority of the proceeds on Hyperliquid after the assets passed through exchanges, bridges and new addresses. The finding also highlights the speed at which stolen cryptocurrency can move across services, making tracing, freezing and recovery efforts more difficult once the funds have been dispersed.
Affected Customers Urged to Establish Fresh Wallets
Affected Ngrave customers have been instructed to create new wallets rather than continue relying on wallets whose credentials may have been exposed. They have also been directed to contact company support. Those steps are intended to reduce the risk that information disclosed during the incident could be used in another targeted attack.
With the investigation still continuing, the immediate focus is on containing the damage, assisting affected users and tightening the notification process. The central unresolved issue is not a failure of the ZERO hardware itself, according to Ngrave, but the extent to which trusted messages and credential-sharing practices enabled criminals to bypass that protection.
Why This Matters
Ngrave’s incident falls within a difficult 2026 for hardware-wallet manufacturers. Nearly a dozen documented security incidents have involved Ledger, Trezor, Tangem, Safepal, Bitbox02 and Coldcard. Reported losses exceeded $180 million across two of those incidents. The vulnerabilities identified across the sector have included firmware weaknesses, compromised third-party vendors, physical-security failures and phishing, rather than direct remote attacks aimed at recovery phrases.
The Ngrave case reinforces that hardware security depends on more than the resistance of the device. A secure wallet cannot fully protect users if the surrounding notification, support and communication channels are manipulated into persuading them to disclose credentials. Ngrave’s replacement of compromised keys and introduction of two-person approvals, restricted domains and emergency shutdown capabilities therefore represent broader changes to operational security, not just technical fixes.
For customers, the immediate next steps are to follow Ngrave’s guidance, establish fresh wallets and seek support if their information may have been exposed. For the company and the wider hardware-wallet sector, the continuing investigation will test whether stronger controls around trusted messages can close a vulnerability that remained outside the hardware itself.
Frequently Asked Questions
Were Ngrave’s ZERO hardware wallets or private keys hacked?
According to Ngrave, the ZERO hardware wallets and private keys remained untouched. The company said criminals instead manipulated customers into surrendering their own credentials, allowing thefts from previously compromised wallets.
Where did the stolen funds go?
The funds traveled through exchanges, blockchain bridges and fresh addresses. Ngrave traced bitcoin into 12 addresses and $XRP through 54 transfers. Bitquery reported that “most of it now sits on Hyperliquid as a Monero token” and estimated that around 81% reached the perps DEX exchange.
What should affected Ngrave customers do?
Affected customers are being urged to establish fresh wallets and contact Ngrave support. They should also remain alert for targeted scams because device information, wallet activity, IP addresses and approximate locations may have been exposed.
