NGRAVE LIQUID phishing follow-up (2026-10-17): 39 Hyperliquid accounts holding ~3,590 XMR1 bought with the stolen funds
- Scam type: Phishing
- Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
- Project or site name: NGRAVE
- Incident date: 2026-10-17
- Reported: 2026-10-24
- Last updated: 2026-10-24
Follow-up to our report on the 2026-10-17 NGRAVE LIQUID fake-alert phishing attack (https://blockint.ai/c3?report=5849e778-8e30-4540-9660-a466d320c59a). That report listed five collecting and transit wallets and named, in its text only, 39 Hyperliquid accounts that bought XMR1 (a token that tracks Monero) with the stolen funds. This report puts those 39 accounts in the address list. BlockintAI research assesses these accounts as the thief's collecting wallets, based on the public facts below (Hyperliquid public API and Arbitrum One RPC, re-checked 2026-10-24, about 8:15 AM CT). Each of the 39…
Other addresses in this report: 0x7314562f742cafda7b6912455d8fb018947a8300, 0x946ade0ee77a5d04e0555f7c041a64442e6692c8, 0xaa084e02bfcab46f433e9ee1a7f997cd7318aeaf, 0x6934bf14bcb6d3bd5e3f7e808450b3b52196a847, 0x3ce89fa6eaad163d58831b52c72820aad32a483e, 0x40c6c101e5a621028323f2042dd3ceb87b612cd5, 0x517e4b2fefc6225b0803e4e53dec8d829871ccb0, 0xe9aeaef59820d3b103395092f9aa3c741290e652, 0xc3f9972d68e4239b14a8961dfda52aad85aafa45, 0x00f3e9025a78128daf775535ac7a398dbb080be3, 0x74d5b492d7dcaefdcf4d63c807fbe25e1bcfee66, 0xe448974cbf8763214508de4c313b92eed9869d5b, 0x9c1411ae256aa2038eaf66641e7f5abc5731a68b, 0x013ce5ac5062f54d2bb124fad422ee2009fe9a92, 0xfb2e034e794ede33add413243829668f7ba3f016, 0xc18cb6c2bbd38defbd5434c1feaf62954cedf485, 0x2a82fd2a872a9daaf96d743debd7b84e229a9479, 0xa140af0eb11576ab7becc483866f8feb209d9535, 0x0413452d9161afa3893c38ea1639c617c03bc7ad, 0xdcfd49c1436b2c5f10b845c61100627641b5d907 and 18 more
Linked reports: NGRAVE LIQUID app fake-alert phishing (2026-10-17): thief's collecting wallets, per Bitquery; about $2.16M moved into XMR1 on Hyperliquid