NGRAVE wallet users lose $2.65 million in phishing attack via hijacked app notifications
Hackers exploited NGRAVE's LIQUID companion app notifications on Oct 17, stealing an estimated $2.65 million across 84 wallets and routing $2.16 million to Hyperliquid accounts.
Why it matters
The attack highlights ongoing vulnerabilities in hardware wallet companion apps and notification systems, raising questions about whether stolen funds can be recovered through exchange cooperation. It compounds pressure on wallet makers to strengthen supply-chain and software security after multiple high-profile incidents.
Where the sources disagree
Figures that do not reconcile
Found by comparing the numbers in the reports automatically. They are differences, not yet confirmed to be about the same thing.
reported count
$2.65 million
CryptoSlate
$1.77 million
Crypto News (CryptoNews.net)
CryptoSlate reports $2.65 million, Crypto News (CryptoNews.net) reports $1.77 million (33% apart).
amount taken
$2.12 million
CryptoSlate
$2.56 million
Bitcoin.com News
CryptoSlate reports $2.12 million, Bitcoin.com News reports $2.56 million (17% apart).
Key facts
Hackers hijacked NGRAVE's LIQUID companion app notifications in a phishing attack on October 17.
Reported by CryptoSlate
The attack resulted in an estimated $2.65 million in cryptocurrency losses across 84 wallets.
2,650,000 USDReported by CryptoSlate
Bitquery traced $2.16 million in suspected proceeds to 39 Hyperliquid accounts.
2,160,000 USDReported by CryptoSlate
The 39 Hyperliquid accounts purchased approximately 3,593 XMR1 tokens for $2.16 million.
3,593 tokensReported by CryptoSlate
As of October 19, the XMR1 tokens had not been sold or withdrawn and were valued at approximately $2.12 million.
2,120,000 USDReported by CryptoSlate
What happened
CryptoSlate reported that hackers hijacked NGRAVE's wallet notifications in a phishing attack on October 17, resulting in an estimated $2.65 million in cryptocurrency losses across 84 wallets. The attack spanned roughly six hours and affected Bitcoin, XRP, Ethereum, Solana, Dogecoin, and Stellar, with Bitcoin accounting for the largest share at approximately $1.76 million from 21 wallets. Blockchain analytics firm Bitquery traced $2.16 million in suspected proceeds to 39 Hyperliquid accounts, which purchased about 3,593 XMR1 tokens. As of October 19, those tokens had not been sold or withdrawn and were valued at approximately $2.12 million. The incident adds to growing security concerns for hardware wallet manufacturers following previous incidents involving SecuX, Coldcard, and Ledger.
How the story developed
- Update
Phishing attack on NGRAVE users begins
Hackers hijack LIQUID companion app notifications
- Update
Bitquery publishes tracing analysis
Analytics firm traces $2.16 million to 39 Hyperliquid accounts and XMR1 token purchases
- First report
First report by CryptoSlate
Crypto wallet security crisis deepens as NGRAVE users face $2.65 million phishing attack
- Update
CryptoSlate reports on the incident
Publication covers the attack and Bitquery findings
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 20 Oct 2026, 14:00 UTC: CryptoSlate — 1 independent source, 1 reports
- 20 Oct 2026, 23:30 UTC: Bitcoin.com News, official — 2 independent sources, 2 reports
- 22 Oct 2026, 08:15 UTC: Bitcoinist — 3 independent sources, 4 reports
Affected entities
Also mentioned: Solana, Monero, Kraken, Dogecoin
Original sources
| Publisher | Report | Role | Published |
|---|---|---|---|
| Bitcoin.com News Company, official | Crypto Thieves Hijack Ngrave Alerts and Walk Away With $2.56M | Independent | |
| CryptoSlate Crypto media | Crypto wallet security crisis deepens as NGRAVE users face $2.65 million phishing attack | Original | |
| Bitcoinist Crypto media | NGRAVE Details $2.56 Million Phishing Attack That Used Fake Wallet Alerts | Independent | |
| Crypto News (CryptoNews.net) Aggregator | Crypto Thieves Hijack Ngrave Alerts and Walk Away With $2.56M | Syndicated |