NGRAVE Phishing Attack Linked to Estimated $2.65 Million in Wallet Losses

A phishing attack carried through NGRAVE’s LIQUID app alerts is linked to an estimated $2.65 million taken from 84 wallets, with most of the traced funds used to buy XMR1 on Hyperliquid.

Attackers gained access to the outside service used to deliver LIQUID push notifications. On Oct. 17, fake security alerts led recipients to a page asking for recovery words or a NGRAVE Perfect Key. Either credential can be used to recreate a wallet and move its assets without the ZERO hardware device.

The traced thefts began at 5:36 p.m. ET (21:36 UTC) on Oct. 17. The activity continued until just before midnight ET (04:00 UTC on Oct. 18). Losses in Bitcoin (BTC) totaled about $1.76 million across 21 wallets. The 84-wallet total spans six blockchains, but transaction records cannot identify which wallet app every owner used.

Funds traced from Bitcoin, Ethereum and Solana reached 39 Hyperliquid accounts, which spent about $2.16 million on 3,592.71 XMR1 tokens. The XMR1 holdings were worth about $2.12 million at 5 a.m. ET (09:00 UTC) on Oct. 19, when none had been sold or withdrawn.

LIQUID is the companion app for NGRAVE’s ZERO hardware wallet. The attack sought users’ recovery credentials through the app’s alerts.