Hackers routed $2.16 million in suspected NGRAVE phishing proceeds to Hyperliquid after hijacking the wallet maker’s app notifications.
Blockchain analytics firm Bitquery traced approximately $2.65 million in suspected losses across 84 cryptocurrency wallets following the Oct. 17 attack, which exploited security notifications sent through NGRAVE’s LIQUID companion app.
The thefts occurred over roughly six hours across Bitcoin, XRP, Ethereum, Solana, Dogecoin and Stellar. Bitcoin accounted for the largest share, with attackers draining about $1.76 million from 21 wallets before moving the proceeds across multiple blockchains.
Bitquery traced much of the stolen Bitcoin through 12 Chainflip swaps, while Ethereum and Solana proceeds passed through bridges before converging on 39 Hyperliquid accounts.
The accounts then purchased about 3,593 XMR1 tokens, a cryptocurrency that tracks the price of privacy-focused Monero, for $2.16 million.
As of Bitquery’s latest recorded check on Oct. 19, the tokens had neither been sold nor withdrawn. Their combined value was about $2.12 million, leaving a substantial portion of the suspected proceeds concentrated in identifiable accounts.
The investigation identified the suspected victims through transaction patterns and reported losses, although other phishing attacks may have affected some of the 84 wallets.
In an Oct. 19 incident report, NGRAVE confirmed that attackers compromised access to a third-party service responsible for delivering LIQUID push notifications.
The fraudulent messages warned users that their cryptocurrency portfolios had been synchronized with a Pixel 9 device in Moscow. After the alerts, victims were directed to a website that asked for their recovery phrases or NGRAVE Perfect Keys.
Those credentials let attackers recreate affected wallets and transfer assets without accessing the ZERO hardware devices, which NGRAVE said kept private keys offline.
Crypto wallet makers face mounting security threats
The incident follows a similar phishing campaign against SecuX users on Oct. 16, raising concerns about attackers exploiting trusted communication channels to target hardware wallet customers.
Nick Percoco, Kraken’s chief security officer, highlighted the similarities between the two incidents, describing NGRAVE as the second wallet manufacturer in two days whose application notifications were used to steal recovery phrases.
The repeated attacks add to a difficult year for hardware wallet manufacturers, whose security models have faced increasingly sophisticated threats.
In July, a firmware vulnerability affecting Coldcard devices weakened the randomness used to generate wallet recovery phrases, allowing attackers to reconstruct private keys. Blockchain intelligence firm TRM Labs estimated that attackers stole about $116 million in Bitcoin.
More recently, Ledger disclosed that criminals modified hardware wallets distributed through resellers, installing hidden components that could capture recovery phrases. Investigators linked the operation to suspected cryptocurrency thefts totaling more than $90 million.
The incidents exposed weaknesses across hardware wallet security, from software vulnerabilities and compromised distribution channels to fraudulent messages delivered through legitimate apps.
For manufacturers, the repeated breaches are increasing pressure to strengthen security beyond the devices themselves, particularly across third-party services and customer-facing infrastructure.
