Phishing campaign tied to NGRAVE wallets losses of $2.65 million
Bitquery traced the stolen funds into XMR1 purchases on Hyperliquid, but said it cannot confirm every affected wallet belonged to an NGRAVE user.
A phishing attack has been linked to roughly $2.65 million in losses from crypto wallets, with the trail initially associated with users of hardware wallet provider NGRAVE. The figure and the wallet attribution come from onchain analysis reported by CryptoSlate.
Blockchain analytics firm Bitquery followed the movement of the funds into XMR1 purchases on Hyperliquid, according to the report, giving investigators a visible path for at least part of the proceeds.
Attribution remains incomplete
Bitquery could not confirm that every wallet involved in the incident belonged to an NGRAVE user, leaving the exact scope of the campaign unresolved. That caveat matters because phishing operations often sweep up addresses across multiple wallet brands and self-custody setups rather than a single vendor's customer base.
The incident adds to a broader pattern of attacks targeting wallet holders directly rather than exchanges or protocols, where a single compromised seed phrase or signing approval can move funds beyond recovery. Hardware wallet providers have generally positioned their devices as a defence against this kind of theft, though phishing typically targets the user rather than the device itself.