NGRAVE Phishing: $2.56M Confirmed, 84 Wallets Traced

NGRAVE’s $2.56M tally differs from the 84-wallet trace

NGRAVE’s accounting covers about 70 addresses on four networks. Separately, Bitquery estimates $2.65 million across 84 wallets on six chains, with holdings checked at 09:00 UTC on October 19. This article’s loss-impact review was completed at 09:04 UTC on October 21.

The estimates overlap. They are not separate losses to add together, and the larger count does not establish a second attack wave. Different network coverage, attribution and valuation methods can change an investigation’s boundaries.

Bitquery cautions that some wallets may relate to other scams and two Bitcoin addresses are less certain. It matched two public victim reports to XRP losses, strengthening the link for those cases without proving ownership of every address.

Its 84-wallet figure also cannot be read as 84 people. One owner can hold addresses on several blockchains, and the investigators observed coordinated transfers across networks. A verified customer count requires matching those transactions to individual reports.

TokenPost’s account of the investigation reports roughly $1.76 million in Bitcoin losses across 21 wallets. It also describes $2.16 million spent on XMR1 through 39 Hyperliquid accounts, with holdings worth about $2.12 million at the October 19 observation time.

Those last two amounts describe purchase cost and a later valuation of overlapping proceeds. Neither is an additional victim-loss total. XMR1 is a token tracking Monero; identifying it in an account does not establish that the funds have been recovered or remain there today.

Bitquery publishes collecting addresses and its tracing method. Daily Crypto Briefs reviewed that evidence and its caveats but did not independently reconstruct the entire transaction ledger. No confirmed aggregate recovery amount appeared in the sources checked.

Fake LIQUID alerts bypassed ZERO’s offline protection

Bitcoin.com’s October 20 report describes attackers using stolen notification-provider access to impersonate NGRAVE. The warning claimed a portfolio had synced to a new device in Moscow, creating pressure to respond immediately.

The lure made a routine defensive action appear dangerous to ignore. A recipient trying to reject the alleged intrusion reached a recovery-credential request instead. Recognizing the app that delivered a message therefore did not authenticate the destination or the requested action.

NGRAVE’s timeline places the first alert at 21:30 UTC and the first theft six minutes later. Disabling one stolen access key at 21:40 did not stop messages sent through a second key; all notification sending was shut down at 22:45. Previously exposed wallets remained vulnerable afterwards.

NGRAVE’s LIQUID product documentation explains the normal separation: the phone app tracks assets and prepares transactions, while ZERO signs through QR-code communication and retains the private keys. That architecture protects a secret held on the device; it cannot retract a separate copy disclosed elsewhere.

The company’s Perfect Key documentation explains that its 64-character hexadecimal backup and a traditional 24-word phrase are alternative representations of the wallet secret. Entering either into an attacker-controlled page can defeat the protection offered by an offline device.

This makes the credential request decisive. A notification arriving inside a familiar app can still direct someone to a hostile site. Device certification does not certify every message sent through the company’s supporting services.

RootData’s October 21 summary also identifies possible exposure of device information, wallet activity, IP addresses and approximate locations. That creates a further impersonation concern: someone who knows an owner’s real holdings can make a subsequent fraudulent support message appear unusually well informed.

Exposed recovery phrases require new NGRAVE wallets

NGRAVE advises people who entered a recovery phrase or Perfect Key to move remaining assets to a new wallet with a new secret across every affected network. Reusing the exposed backup on a replacement device would preserve the attacker’s access.

The company distinguishes that situation from merely opening the link without entering credentials. Owners should use its incident guidance to identify their case, rather than assume every recipient suffered the same compromise.

NGRAVE says it replaced live-system keys and plans tighter notification permissions, restrictions on external links, two-person message approval and an emergency shutdown control. Its report lists these safeguards as forthcoming changes, so publication of the list should not be treated as confirmation that every measure is already deployed.

NGRAVE’s recovery-seed storage guidance explains why the backup needs separate protection: wallet addresses derive from it, so its exposure can affect multiple holdings. It advises keeping recovery material offline and avoiding digital photographs or copies on connected devices.

The distinction also appeared in SafePal’s customer-data disclosure, where exposed order records created impersonation risks without establishing wallet theft. A convincing message can use genuine information while making an unauthorized request for a secret.

For affected owners, NGRAVE’s getting-started guide covers creating a wallet, backing it up and signing transfers. A new receiving address alone is insufficient if it is still derived from the exposed recovery material.

Alternative.me’s Fear & Greed Index read 63 on October 21, compared with 55 the previous day. This measures broader market sentiment, not the safety of a wallet or the probability of recovering stolen assets.

The unresolved questions are how many customers can be definitively matched to the traced addresses and how much can be frozen or returned. Future updates need dated recovery evidence; a visible balance or freeze request alone does not establish that victims have been repaid.