Attackers who hijacked the companion app notifications of cryptocurrency wallet maker NGRAVE successfully routed $2.16 million in suspected phishing proceeds to the Hyperliquid platform, according to blockchain analytics data.
The security breach, which unfolded on October 17, has left approximately $2.65 million in total losses distributed across 84 different cryptocurrency wallets, based on tracing conducted by blockchain intelligence firm Bitquery. The operation relied on exploiting security notifications dispatched through the LIQUID companion app, a trusted channel that users rely upon for real-time updates regarding their account status and asset security.
The systematic theft occurred over a volatile six-hour window, affecting multiple major digital assets including Bitcoin, XRP, Ethereum, Solana, Dogecoin, and Stellar. Bitcoin bore the brunt of the malicious activity, with threat actors forcefully draining roughly $1.76 million from 21 distinct wallets before rapidly fragmenting and moving the proceeds across a complex web of multiple blockchains to obfuscate the trail.
Detailed blockchain investigations by Bitquery revealed that a significant portion of the stolen Bitcoin was laundered through 12 Chainflip swaps. Concurrently, the Ethereum and Solana proceeds were routed through various decentralized bridges before ultimately converging on 39 accounts established on Hyperliquid.
Once consolidated within these Hyperliquid accounts, the illicit funds were utilized to purchase approximately 3,593 XMR1 tokens—a synthetic digital asset that strictly tracks the market price of the privacy-focused cryptocurrency Monero—amounting to $2.12 million to $2.16 million in valuation.
As of Bitquery’s most recent comprehensive audit conducted at 09:00 UTC on October 19, these privacy-tracking tokens remained completely untouched, sitting dormant within the identified accounts without having been sold off or withdrawn to external addresses. This left a substantial portion of the suspected proceeds concentrated in clearly traceable, identifiable accounts, offering investigators a valuable window into the perpetrators’ post-breach financial maneuvers.
Bitquery’s rigorous investigation successfully mapped out the suspected victims by cross-referencing intricate transaction patterns with officially reported losses, though analysts noted that some of the 84 impacted wallets may have concurrently fallen victim to separate, unrelated phishing campaigns.
In an official incident report published on October 19, NGRAVE publicly confirmed the mechanics of the breach, acknowledging that malicious actors had successfully compromised external access to a vital third-party service provider responsible for orchestrating and delivering LIQUID push notifications.
The fraudulent push notifications were meticulously crafted to induce panic, falsely warning users that their sensitive cryptocurrency portfolios had been inexplicably synchronized with a mysterious Pixel 9 device physically located in Moscow, Russia. Once recipients interacted with or clicked through the alarming alerts, they were seamlessly redirected to a sophisticated phishing website designed to mimic official infrastructure. This malicious portal explicitly demanded that users input their master recovery phrases or proprietary NGRAVE Perfect Keys under the guise of verifying or securing their accounts.
By obtaining these vital security credentials, the attackers gained the exact keys needed to remotely recreate the affected wallets and effortlessly transfer out all digital assets. Crucially, this vector bypassed the physical ZERO hardware devices entirely, validating NGRAVE’s statements that their hardware private keys remained securely stored offline, even as the broader security perimeter crumbled due to the notification system’s compromise.
Crypto Wallet Makers Face Mounting Security Threats
This brazen exploit did not occur in a vacuum, following closely on the heels of a remarkably similar phishing campaign targeting users of SecuX just a day prior on October 16. The sequential nature of these events immediately ignited widespread industry concern regarding how threat actors are increasingly weaponizing trusted communication channels—specifically customer-facing notification infrastructure—to deceive hardware wallet customers into willingly surrendering their master keys.
Nick Percoco, the chief security officer at cryptocurrency exchange Kraken, took to social media to draw direct parallels between the two consecutive events. Percoco highlighted NGRAVE as the second hardware wallet manufacturer in a mere 48-hour span whose official application notifications had been actively hijacked and subverted to trick users into divulging their recovery phrases.
These repeated, targeted attacks represent the latest escalation in what has proven to be a profoundly challenging year for the hardware wallet manufacturing sector as a whole. Throughout 2026, the traditional security models that consumers have long relied upon to protect their self-custodied wealth have been subjected to increasingly sophisticated and multifaceted threats.
Back in July, the cryptocurrency ecosystem reeled from a severe firmware vulnerability that critically undermined Coldcard hardware wallet devices. The flaw weakened the cryptographic randomness algorithms utilized during the generation of wallet recovery phrases, theoretically empowering attackers to mathematically reconstruct private keys. Blockchain intelligence firm TRM Labs estimated that the fallout from the Coldcard crisis resulted in approximately $116 million worth of Bitcoin being stolen in what stood out as one of the largest hardware wallet exploits of the year.
More recently, hardware wallet pioneer Ledger issued disclosures revealing that criminal enterprises had successfully intercepted and modified physical hardware wallets distributed through unauthorized or third-party resellers. These tampered devices had hidden, malicious hardware components covertly installed inside them, specifically engineered to capture and transmit recovery phrases to bad actors. Independent investigators subsequently linked this supply chain manipulation operation to suspected cryptocurrency thefts surpassing $90 million in total damages.
Taken together, these high-profile incidents have exposed critical structural weaknesses spanning the entire lifecycle of hardware wallet security. From vulnerable firmware code and compromised retail supply chains to fraudulent, social-engineering alerts delivered directly through legitimate software applications, the threat landscape has grown exponentially more complex.
For manufacturers across the industry, these recurring breaches are creating intense, mounting pressure to fundamentally overhaul their security postures. Companies are now forced to look far beyond the physical boundaries of the hardware devices themselves, implementing rigorous safeguards across third-party service providers, cloud notification systems, and all customer-facing software infrastructure to prevent future exploitation of their user bases.
