NGRAVE Users Lose $2.65 Million in Phishing Scam via LIQUID Push Notifications
Current overview (not historical)
NGRAVE users were targeted by a phishing attack that hijacked the company’s LIQUID push notifications, tricking them into revealing recovery phrases or NGRAVE Perfect Keys. Attackers then rebuilt wallets without accessing the hardware devices and transferred the assets. According to blockchain‑analysis firm Bitquery, the incident on Oct. 17 resulted in approximately $2.65 million lost across 84 wallets. An additional $2.16 million of suspected scam funds was routed to Hyperliquid. The event highlights the vulnerability of users to social‑engineering attacks even when using hardware‑based wallets.
Written with AI from the reporting · updated 10/20/2026
Expand the detailed fact route and sources
Story route
A station-by-station route from the first public evidence onward; every station carries its own evidence and uncertainty.
- 1Unclassified fact stationOct 17, 00:00recorded Oct 20, 22:06single sourcerevised
NGRAVE用户遭遇265万美元钓鱼攻击
Read original source ↗ CryptoSlateReplay this moment in the explorerEvidence & revisions · 1 source records
- Subject：
- ngrave
- Action：
- 用户钱包被盗
- Object：
- 加密资产
- Occurred (fact side)：
- Oct 17, 00:00
- Published (valid side)：
- Oct 20, 22:00
- First seen (known side)：
- Oct 20, 22:06
Fact stationSingle source · one-sided claimRevisedCopy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.
Uncertainty marks flag where to check the sources; they are not proven causation.
Report timeline
Explore every side through dated source reports.
- CryptoSlateRelated fact: single sourceSource report revisedNGRAVE users lose $2.65 million in phishing attack exploiting LIQUID app notifications
Report first recorded Oct 20, 22:06
Hackers stole approximately $2.65 million from 84 cryptocurrency wallets by compromising NGRAVE's LIQUID companion app push notifications in an Oct. 17 attack. The fraudulent messages falsely warned users their portfolios had been synchronized with a Pixel 9 device in Moscow, directing victims to enter recovery phrases or NGRAVE Perfect Keys. Attackers drained about $1.76 million in Bitcoin from 21 wallets and moved proceeds across multiple blockchains, eventually purchasing $2.16 million worth of XMR tokens tracked to Monero's price. As of Oct. 19, the XMR tokens remained unsold and unwrapped in identifiable accounts.
Read original source ↗
Event discussion
Reader opinions are hosted on GitHub Discussions; posting requires a GitHub account. Comments are not verified facts.