NGRAVE users face $2.65 million phishing attack as hackers exploit app notifications

Hackers routed 2.16 million dollars in suspected NGRAVE phishing proceeds to Hyperliquid after hijacking the wallet maker's app notifications. Blockchain analytics firm Bitquery traced approximately 2.65 million dollars in suspected losses across 84 cryptocurrency wallets following the October 17 attack, which exploited security notifications sent through NGRAVE's LIQUID companion app. The thefts occurred over roughly six hours across Bitcoin, XRP, Ethereum, Solana, Dogecoin, and Stellar, with Bitcoin accounting for the largest share at about 1.76 million dollars drained from 21 wallets. Much of the stolen Bitcoin was traced through 12 Chainflip swaps, while Ethereum and Solana proceeds passed through bridges before converging on 39 Hyperliquid accounts. The accounts then purchased about 3,593 XMR1 tokens for 2.16 million dollars. As of Bitquery's latest recorded check on October 19, the tokens had neither been sold nor withdrawn, with a combined value of about 2.12 million dollars. NGRAVE confirmed that attackers compromised access to a third-party service responsible for delivering LIQUID push notifications, directing victims to a fraudulent website asking for recovery phrases or NGRAVE Perfect Keys. This incident follows a similar phishing campaign against SecuX users on October 16, raising concerns about security threats to hardware wallet manufacturers. The repeated attacks highlight weaknesses in hardware wallet security, increasing pressure on manufacturers to strengthen security across third-party services.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.