Users of crypto hardware wallet maker NGRAVE have lost $2.65 million to a phishing attack, according to on-chain tracking firm Bitquery. The stolen funds were traced into purchases of XMR1 — a Monero-linked token — on the decentralized exchange Hyperliquid, a conversion that makes the money harder to follow.
One caveat up front: it can't be confirmed that every affected wallet actually belonged to an NGRAVE user. That gap matters, because the headline number covers all wallets Bitquery flagged, not just a verified customer list.
The Monero detour
Bitquery's tracing shows the stolen assets moving from victim wallets into XMR1 positions on Hyperliquid. That's a familiar playbook for thieves — swap into a privacy-adjacent asset, then move it again before anyone freezes the trail. It doesn't mean the funds are gone forever, but it does slow down response.
The timing isn't great for hardware wallet makers, either. They're the products people buy specifically to avoid this kind of loss. When a phishing campaign hits a wallet brand's users, the damage is as much reputational as financial.
What's actually confirmed
The one hard number here is the $2.65 million loss figure attributed to Bitquery. The attribution to NGRAVE users is the part with an asterisk. Phishing campaigns often cast a wide net — fake support channels, spoofed login pages, social engineering over Telegram — and it's common for victims to be lumped in with a brand because that's the logo on the hook. Whether every wallet on Bitquery's list was genuinely an NGRAVE customer is unresolved.
NGRAVE has not issued a public statement that appears in the record here. Nor is there any detail on how the attackers got in — which is usually the first question customers ask and the last one answered.
A widening wallet-security problem
This incident is being characterized as part of a deepening crypto wallet security crisis, and the description fits. Phishing remains one of the cheapest attacks in the book — no exploit, no zero-day, just a convincing page and a user who's in a hurry. The $2.65 million figure is small next to some of the exchange hacks of recent years, but it's large enough to matter for a consumer-focused wallet brand.
For Hyperliquid, the XMR1 buying adds another wrinkle. Decentralized venues have limited tools to flag incoming funds, and by the time a laundering trail is public, the trades are usually settled.
What to watch
The next concrete step is attribution: whether NGRAVE confirms the customer list and issues guidance, and whether Bitquery's wallet set narrows once duplicate or misattributed addresses are removed. Until then, the $2.65 million is a real number attached to a less-than-certain list of victims. Users holding NGRAVE devices would be wise to assume nothing about a phishing attempt is over just because it's public.
