Crypto wallet security crisis deepens as NGRAVE users face $2.65 million phishing attack
Bitquery follows funds into XMR1 purchases on Hyperliquid, but cannot confirm every wallet belonged to an NGRAVE user. Read the full story on CryptoSlateUnderstand the crypto stories that matter and what to watch next. Get The Catalyst in your inbox
Hackers routed $2.16 million in suspected NGRAVE phishing proceeds to Hyperliquid after hijacking the wallet maker's app notifications.
Blockchain analytics firm Bitquery traced approximately $2.65 million in suspected losses across 84 cryptocurrency wallets following the Oct. 17 attack, which exploited security notifications sent through NGRAVE's LIQUID companion app.
The thefts occurred over roughly six hours across Bitcoin, XRP, Ethereum, Solana, Dogecoin and Stellar. Bitcoin accounted for the largest share, with attackers draining about $1.76 million from 21 wallets before moving the proceeds across multiple blockchains.
Bitquery traced much of the stolen Bitcoin through 12 Chainflip swaps, while Ethereum and Solana proceeds passed through bridges before converging on 39 Hyperliquid accounts.
The accounts then purchased about 3,593 XMR1 tokens, a cryptocurrency that tracks the price of privacy-focused Monero, for $2.16 million.
As of Bitquery's latest recorded check on Oct. 19, the tokens had neither been sold nor withdrawn. Their combined value was about $2.12 million, leaving a substantial portion of the suspected proceeds concentrated in identifiable accounts.
The investigation identified the suspected victims through transaction patterns and reported losses, although other phishing attacks may have affected some of the 84 wallets.
In an Oct. 19 incident report, NGRAVE confirmed that attackers compromised access to a third-party service responsible for delivering LIQUID push notifications.