NGRAVE LIQUID app fake-alert phishing (2026-10-17): thief's collecting wallets, per Bitquery; about $2.16M moved into XMR1 on Hyperliquid
- Scam type: Phishing
- Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
- Project or site name: NGRAVE
- Incident date: 2026-10-17
- Reported: 2026-10-20
- Last updated: 2026-10-20
Fake alerts sent through NGRAVE's LIQUID phone app led owners to a page that asked for their recovery words. What happened: NGRAVE confirmed on X that LIQUID's notifications had been hijacked and told users never to enter their seed (https://x.com/ngrave_official/status/2111585528432689380). It later said that users who only tapped the link, and typed or downloaded nothing, were safe (https://x.com/ngrave_official/status/2111605372075032762). The Ethereum and Solana loot went through swaps and bridges to Arbitrum. All three ended in 39 new Hyperliquid accounts that bought about 3,592.71 XMR1,…
Other addresses in this report: bc1qtsp4s6mv8536lwnc7zjz87p66k6ldt0g88nl60, 9jpSiqecXKiufE3Cm1Z7GCRoutq5YMeiNXY6eGtDsijf, 0x180dafda2bb904619af5f41e717fd6af73b98a1b, 0x3692bdba656d140227421a32abb53bd81accb725