Fake NGRAVE app alerts drained $2.65M from 84 wallets. Most of it now sits on Hyperliquid as a Monero token

01 · What owners sawAn alert from their own wallet app, then an empty wallet

A message pops up on your phone. It comes from your own wallet app. It says your portfolio was just synced on a new phone in Moscow.

That is what owners of NGRAVE wallets saw on the evening of 17 October. The alert came from LIQUID, the phone app that comes with NGRAVE's ZERO wallet. Tapping it opened a page with a timer and a button to deny the sync. The next page asked for the owner's recovery words.

NGRAVE is a Belgian company that makes the ZERO, a hardware wallet: a small device that keeps the keys to your crypto away from the internet. LIQUID shows your balances and helps you send coins, but it never holds the keys. That is why the alert worked. It came from an app people trust, and it asked them to type the one thing the device exists to protect.

The first public warning appeared on X a little after 22:00 UTC. Within the half hour NGRAVE confirmed that LIQUID's notifications had been hijacked, and told users never to enter their seed. It took LIQUID offline for repairs that night and brought it back the next evening. By then it had answered over 1,000 support tickets, and it said only a small share came from people who had lost money.

Bitquery reads the full public record of every chain involved, so we went looking for the wallets that were emptied that night. We found one thief who took $2.65M from 84 wallets on six chains in about six hours. Most of that money is no longer Bitcoin or Ether. It sits on Hyperliquid, a crypto exchange with its own blockchain, as a token that tracks Monero, a coin built to hide who pays whom. On the morning of 19 October the money had not moved. The record cannot prove that every one of those wallets belonged to an NGRAVE owner, and section 04 explains how sure we are.

02 · The words that open everythingWhoever has your recovery words owns your coins

When you set up a hardware wallet, it gives you a list of words, called the recovery phrase or seed. NGRAVE calls its version the Perfect Key. Those words are the master key to your money. Anyone who has them can rebuild your wallet on another device and send everything out, with no access to your phone or your ZERO.

One recovery phrase opens a wallet on every chain the device supports. The ZERO holds Bitcoin, Ether, XRP, Solana, Dogecoin, Stellar and more under the same words. A thief who gets the words can empty all of those wallets at once, and that is what the record shows.

The fake page used a simple trick. The "deny" button made the next page look like a security step. NGRAVE later explained that anyone who only tapped the link, and typed or downloaded nothing, was safe. Typing the words was what cost people their money.

03 · Six hours, six chainsThe thief emptied wallets on six chains in one night

The first wallet was emptied at 21:36 UTC, before anyone had warned the public. Within three minutes the thief had taken coins on Ethereum, XRP and Solana. Stellar, Dogecoin and Bitcoin followed within the half hour. Most wallets were emptied in the first two hours, and the last went shortly before 04:00 UTC.

On each chain the thief sent everything to one collecting wallet, an address that gathers the coins before they move on. All six were new or close to new. The full histories behind this chart are in Bitquery's data for Bitcoin, XRP, Ethereum, Solana, Dogecoin and Stellar.

One more chain may belong in that table. On Zcash, a new address emptied two idle wallets at 21:50 and 22:14 UTC, each a few seconds after an XRP theft in the same burst. It took 252 ZEC, worth about $285k, and 150 ZEC of it had not moved on the morning of 19 October. Two thefts are too few to rule out chance, so we leave Zcash out of the totals and list the address below.

04 · One thief, and the link to NGRAVEThe same stolen words, swept on several chains within two minutes

A thief who holds one person's recovery words can open that person's wallets on every chain at the same moment. That leaves a clear mark. Again and again that night, a wallet on one chain was emptied within two minutes of a wallet on another. We found 15 such bursts. In the last one, at 03:12 UTC, the thief emptied XRP, Ethereum, Solana and Stellar wallets within 90 seconds.

The bursts tie four of the chains to one hand. If the thefts on Solana and Ethereum were unrelated, chance would put two to four Solana thefts that close to an Ethereum one. We found nine. Dogecoin's three thefts also landed within half a minute of Ethereum ones.

The collecting wallets point the same way. The XRP and Ethereum ones were first funded on 8 October, three minutes apart, and on 17 October they started and stopped within a minute of each other. The Dogecoin and Stellar collectors were emptied six seconds apart. Bitcoin is tied more loosely. Its collector took its first wallet 24 minutes after the first theft, and its money took the same road into Hyperliquid.

The strongest link to NGRAVE comes from the owners themselves. Two people said on X that the fake NGRAVE alert had cost them money, and named what they lost. One wrote that it was "$28k of XRP". That night a wallet lost 21,810 XRP, worth $28.4k at the time. The other wrote "4000 xrp", and a wallet holding exactly 4,000 XRP was emptied the same night.

The timing fits as well. The thefts began the same evening the fake alerts went out and stopped a few hours after NGRAVE shut the app down. The night was also far from normal. A few long-idle wallets get emptied on any night, but this one ran about three times higher on XRP and Bitcoin.

What the record cannot show is which app or device a wallet was used with. The same thief emptied one wallet on 15 October, about four hours before the first public warning about SecuX, another wallet maker whose app was used the same way (section 08). So a few of the 84 wallets may belong to people who were tricked somewhere else. NGRAVE could settle the question. LIQUID knows the public addresses its users have synced, and the company could check them against the list below in minutes.

05 · Who lost whatBitcoin was two thirds of the money, and nine wallets lost most of it

Bitcoin made up 67% of what was taken. XRP came next, then Ether and its tokens. Solana, Dogecoin and Stellar together came to under 5%.

Most victims lost a few thousand dollars or less. A small group lost far more. Nine wallets each lost more than $100k, and together they account for two thirds of the total. The largest single loss was in Bitcoin.

Many of these wallets looked like long-term savings. Twelve of the Bitcoin addresses had never sent a coin before the thief emptied them, and some had sat untouched for more than three years. On XRP, 21 of the 22 accounts had been quiet for at least nine days before the theft. The timing points to 30 to 40 people behind the 84 wallets, because many owners held coins on several chains.

06 · Where the money wentThrough swap services and bridges, into fresh accounts

The thief moved fast. Within a few hours almost everything had left the collecting wallets, through services that turn one coin into another or carry it from one blockchain to another.

Shortly after midnight UTC the thief sent the Bitcoin to Chainflip, a service that swaps coins between blockchains, in a dozen lots of mostly 2 BTC. Each swap paid out within minutes on Ethereum, mostly in ETH, to wallets the thief had just made. The thief then split that ETH across 29 fresh wallets.

The Ethereum loot had moved earlier. At 23:28 UTC the collector sent almost everything it held to a new wallet, which swapped the tokens into ETH and handed the ETH to six more new wallets.

The SOL was swapped into USDC, a dollar stablecoin, on Jupiter, a Solana trading app, and sent through Mayan, a bridge that carries coins between chains. The USDC arrived on Arbitrum, a cheaper network that runs on top of Ethereum, at 01:11 UTC.

All three routes ended the same way. Each fresh wallet used a bridge such as LI.FI to move its money to Arbitrum as USDC, then paid it into Hyperliquid. The money arrived in 39 separate accounts.

The XRP took a different road. It went to a swap service in 54 separate orders, most of them in the first hour after midnight UTC. Each carried its own tag, the number a service uses to tell one customer's deposit from another. We could not name the service or prove where the XRP went next. The Dogecoin and Stellar left the same way, in round amounts, a little later, to services we could not name either.

07 · $2.16M parked in a Monero tokenMost of the loot became a Monero token on Hyperliquid, and stayed there

Monero hides who pays whom and how much. Hyperliquid lists a token called XMR1 that stands for Monero and can be withdrawn as real Monero. Each of the thief's 39 accounts moved its USDC to Hyperliquid's spot market, where coins are bought outright, and bought XMR1 within seconds of arriving.

Those buys stand out on Hyperliquid itself. From 13 to 19 October, a normal eight hours saw nine or fewer new accounts buy XMR1 in a single burst. The theft night broke that pattern. Between 16:00 and midnight UTC on 17 October, 13 did, three of them the thief's. Between midnight and 08:00 UTC on 18 October, 46 did, and we traced 34 of them back to the thief.

On the morning of 19 October, none of these accounts had sold a single XMR1 or sent any of it out. At that morning's price the holding was worth about $2.12M. Once it is withdrawn to the Monero chain, it becomes very hard to follow. Until then it sits in accounts on one exchange. The full list of accounts is in the address section below.

08 · SecuX, a day earlierAnother wallet maker's app was used the same way

NGRAVE was the second wallet maker that week whose own app pushed owners towards a fake recovery page. On 16 October SecuX users reported a phishing link sent through the SecuX app, and Ripple's former chief technology officer David Schwartz flagged one on Android. On 19 October SecuX said hackers had changed a banner inside its app to show links to fake SecuX sites.

We looked at the wallets drained on XRP around the SecuX attack. They went to different collecting wallets, and the transfers carried the marks of a different wallet app. We found no on-chain link between those thefts and the NGRAVE thief. The one wallet this thief emptied on 15 October fell on the same evening, but nothing on-chain shows whether its owner used SecuX.

09 · What NGRAVE owners should doIf you typed your words anywhere, they are no longer yours

If you entered your recovery words or Perfect Key on any page that night, treat them as stolen, even if your wallet still shows a balance. NGRAVE's advice is to send your coins to a temporary wallet, reset the ZERO, make a new Perfect Key and send the coins back to the new addresses. Do it for every chain the words opened, because the thief empties them together.

If you only tapped the alert, and typed or downloaded nothing, NGRAVE says you are safe. The same rule holds for any wallet: no real app or support team will ever ask for your recovery words. If you lost money, send NGRAVE and your local police the time of the loss and the address it went to. The collecting wallets and Hyperliquid accounts listed below are where investigators can start.

10 · How we traced itMethod

We searched each chain's public record for wallets that were emptied in one go on the night of 17 to 18 October and sent to new addresses. We kept the addresses that collected from several such wallets, checked them against a normal night and against each other's timing, and then followed the money through each swap and bridge by amount and time. On Hyperliquid we read every buy and every request each account made. Each total we quote was checked a second time, from scratch, by a separate review.

The same records are open through Bitquery's APIs for Bitcoin, XRP, Ethereum, Solana, Dogecoin and Stellar, and the service names come from Bitquery's address labels. They can also be followed with the Bitquery MCP, which lets you ask an AI assistant where a wallet's money went. The full chain histories are sold as files on the Bitquery Data Store. Earlier hardware-wallet thefts we traced follow a similar path, including the Ledger CryptoBilis hack and the Coldcard wallet hack, and the NEAR Intents theft used some of the same cash-out services.

11 · The thief's addressesWhere to look

These are the thief's collecting wallets and the Hyperliquid accounts that hold the XMR1. Victim addresses are left out on purpose.

FAQ

Was NGRAVE hacked?

NGRAVE says the notification system of its LIQUID app was hijacked and used to send fake alerts. It says the ZERO device and the keys stored on it were not touched. People lost money when they typed their recovery words or Perfect Key into the fake page the alerts pointed to.

How much was stolen in the NGRAVE hack?

We count $2.65M taken from 84 wallets on Bitcoin, XRP, Ethereum, Solana, Dogecoin and Stellar, over the night of 17 to 18 October. Bitcoin was two thirds of it. A few of these wallets may belong to people tricked by another scam run by the same thief.

Where did the stolen money go?

About 81% of it was swapped and bridged into 39 new Hyperliquid accounts and turned into XMR1, a token that tracks Monero. On the morning of 19 October none of it had been sold or withdrawn. The XRP left through a swap service, and the Dogecoin and Stellar through others.

Is the NGRAVE ZERO still safe to use?

Nothing in the record shows a break in the ZERO itself. Every loss we traced came from recovery words typed into a fake page. NGRAVE says LIQUID is working again. Never type your recovery words or Perfect Key into any app or website.

I tapped the fake LIQUID alert. Is my wallet safe?

NGRAVE says you are safe if you only tapped the link and typed or downloaded nothing. Typing your recovery words or Perfect Key is what gives them away. If you typed them, move your coins to a wallet with new words straight away.

What is XMR1 on Hyperliquid?

XMR1 is a token on Hyperliquid that stands for Monero and can be withdrawn as real Monero. The thief bought 3,593 XMR1 with the stolen money, which would make the coins very hard to follow once they leave Hyperliquid.