- Scam type: Phishing
- Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
- Project or site name: NGRAVE
- Incident date: 2026-10-17
- Reported: 2026-10-24
- Last updated: 2026-10-24
Follow-up to our report on the 2026-10-17 NGRAVE LIQUID fake-alert phishing attack (https://blockint.ai/c3?report=5849e778-8e30-4540-9660-a466d320c59a). That report listed five collecting and transit wallets and named, in its text only, 39 Hyperliquid accounts that bought XMR1 (a token that tracks Monero) with the stolen funds. This report puts those 39 accounts in the address list. BlockintAI research assesses these accounts as the thief's collecting wallets, based on the public facts below (Hyperliquid public API and Arbitrum One RPC, re-checked 2026-10-24, about 8:15 AM CT). Each of the 39…
Other addresses in this report: 0x7314562f742cafda7b6912455d8fb018947a8300, 0x946ade0ee77a5d04e0555f7c041a64442e6692c8, 0xaa084e02bfcab46f433e9ee1a7f997cd7318aeaf, 0x6934bf14bcb6d3bd5e3f7e808450b3b52196a847, 0x3ce89fa6eaad163d58831b52c72820aad32a483e, 0x40c6c101e5a621028323f2042dd3ceb87b612cd5, 0x517e4b2fefc6225b0803e4e53dec8d829871ccb0, 0xe9aeaef59820d3b103395092f9aa3c741290e652, 0xc3f9972d68e4239b14a8961dfda52aad85aafa45, 0x00f3e9025a78128daf775535ac7a398dbb080be3, 0x74d5b492d7dcaefdcf4d63c807fbe25e1bcfee66, 0xe448974cbf8763214508de4c313b92eed9869d5b, 0x9c1411ae256aa2038eaf66641e7f5abc5731a68b, 0x013ce5ac5062f54d2bb124fad422ee2009fe9a92, 0x5c004ac24245f99ee8e104e4f9fa5b15119d6072, 0xfb2e034e794ede33add413243829668f7ba3f016, 0xc18cb6c2bbd38defbd5434c1feaf62954cedf485, 0x2a82fd2a872a9daaf96d743debd7b84e229a9479, 0xa140af0eb11576ab7becc483866f8feb209d9535, 0x0413452d9161afa3893c38ea1639c617c03bc7ad and 19 more
Linked reports: NGRAVE LIQUID app fake-alert phishing (2026-10-17): thief's collecting wallets, per Bitquery; about $2.16M moved into XMR1 on Hyperliquid