BitcoinBTC, coin
DisputedHackOfficial source

NGRAVE wallet users lose $2.65 million in phishing attack via hijacked app notifications

Hackers exploited NGRAVE's LIQUID companion app notifications on Oct 17, stealing an estimated $2.65 million across 84 wallets and routing $2.16 million to Hyperliquid accounts.

Why it matters

The attack highlights ongoing vulnerabilities in hardware wallet companion apps and notification systems, raising questions about whether stolen funds can be recovered through exchange cooperation. It compounds pressure on wallet makers to strengthen supply-chain and software security after multiple high-profile incidents.

Where the sources disagree

Figures that do not reconcile

Found by comparing the numbers in the reports automatically. They are differences, not yet confirmed to be about the same thing.

reported count

$2.65 million

CryptoSlate

$1.77 million

Crypto News (CryptoNews.net)

CryptoSlate reports $2.65 million, Crypto News (CryptoNews.net) reports $1.77 million (33% apart).

amount taken

$2.12 million

CryptoSlate

$2.56 million

Bitcoin.com News

CryptoSlate reports $2.12 million, Bitcoin.com News reports $2.56 million (17% apart).

Key facts

Hackers hijacked NGRAVE's LIQUID companion app notifications in a phishing attack on October 17.

Reported by CryptoSlate

The attack resulted in an estimated $2.65 million in cryptocurrency losses across 84 wallets.

2,650,000 USDReported by CryptoSlate

Bitquery traced $2.16 million in suspected proceeds to 39 Hyperliquid accounts.

2,160,000 USDReported by CryptoSlate

The 39 Hyperliquid accounts purchased approximately 3,593 XMR1 tokens for $2.16 million.

3,593 tokensReported by CryptoSlate

As of October 19, the XMR1 tokens had not been sold or withdrawn and were valued at approximately $2.12 million.

2,120,000 USDReported by CryptoSlate

What happened

CryptoSlate reported that hackers hijacked NGRAVE's wallet notifications in a phishing attack on October 17, resulting in an estimated $2.65 million in cryptocurrency losses across 84 wallets. The attack spanned roughly six hours and affected Bitcoin, XRP, Ethereum, Solana, Dogecoin, and Stellar, with Bitcoin accounting for the largest share at approximately $1.76 million from 21 wallets. Blockchain analytics firm Bitquery traced $2.16 million in suspected proceeds to 39 Hyperliquid accounts, which purchased about 3,593 XMR1 tokens. As of October 19, those tokens had not been sold or withdrawn and were valued at approximately $2.12 million. The incident adds to growing security concerns for hardware wallet manufacturers following previous incidents involving SecuX, Coldcard, and Ledger.

How the story developed

  1. Update

    Phishing attack on NGRAVE users begins

    Hackers hijack LIQUID companion app notifications

    CryptoSlate

  2. Update

    Bitquery publishes tracing analysis

    Analytics firm traces $2.16 million to 39 Hyperliquid accounts and XMR1 token purchases

    CryptoSlate

  3. First report

    First report by CryptoSlate

    Crypto wallet security crisis deepens as NGRAVE users face $2.65 million phishing attack

    CryptoSlate

  4. Update

    CryptoSlate reports on the incident

    Publication covers the attack and Bitquery findings

    CryptoSlate

How coverage built up

Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.

20 Oct, 14:003 independent sources22 Oct, 08:15
  • 20 Oct 2026, 14:00 UTC: CryptoSlate — 1 independent source, 1 reports
  • 20 Oct 2026, 23:30 UTC: Bitcoin.com News, official — 2 independent sources, 2 reports
  • 22 Oct 2026, 08:15 UTC: Bitcoinist — 3 independent sources, 4 reports

Affected entities

Also mentioned: Solana, Monero, Kraken, Dogecoin

Original sources

PublisherReportRolePublished
Bitcoin.com News
Company, official
Crypto Thieves Hijack Ngrave Alerts and Walk Away With $2.56MIndependent
CryptoSlate
Crypto media
Crypto wallet security crisis deepens as NGRAVE users face $2.65 million phishing attackOriginal
Bitcoinist
Crypto media
NGRAVE Details $2.56 Million Phishing Attack That Used Fake Wallet AlertsIndependent
Crypto News (CryptoNews.net)
Aggregator
Crypto Thieves Hijack Ngrave Alerts and Walk Away With $2.56MSyndicated