High0xCERT-2026-0259·2026-10-17

Ngrave LIQUID Notification Phishing

Attackers hijacked the push-notification provider behind Ngrave's LIQUID app and sent fake alerts that phished recovery phrases, draining about 70 wallets for roughly $2.56 million.

Vuln-watch · relayed from a public source; see Source & attribution below

Affected chainsBitcoinOther / Multi-chainEthereum

Summary

Attackers hijacked the push-notification provider behind Ngrave's LIQUID app and sent fake alerts that phished recovery phrases, draining about 70 wallets for roughly $2.56 million.

Incident

Victim: Ngrave
Date (UTC): 2026-10-17
Estimated loss: $2.6M
Chain(s): Bitcoin, XRP Ledger, Ethereum, Stellar
Attack type: phishing / social engineering
Funds status: stolen

Recommended actions

Revoke token approvals granted to Ngrave contracts until the project confirms they are safe
Integrators: pause or delist affected assets and monitor for attacker fund movements
Beware of follow-on phishing: ignore unofficial "refund", "recovery", or "claim" links and DMs; use the project's verified channels only

Source & attribution

Full analysis on Blockchain Breaches, 0xCERT's incident archive: https://www.blockchainbreaches.com/en/breaches/ngrave-2026. Primary sources: https://news.bitcoin.com/security/crypto-thieves-hijack-ngrave-alerts-and-walk-away-with-2-56m/ ; https://www.kucoin.com/news/flash/ngrave-phishing-attack-steals-2-56m-from-70-wallets ; https://www.chaincatcher.com/en/article/2297714 ; https://cryptonews.net/news/security/33624607/.

References

Indicators of compromise

All IOC feeds →

address0x00f3e9025a78128daf775535ac7a398dbb080be3NGRAVE thief Hyperliquid account, XMR1 bought with Bitcoin loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0x013ce5ac5062f54d2bb124fad422ee2009fe9a92NGRAVE thief Hyperliquid account, XMR1 bought with Bitcoin loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0x0413452d9161afa3893c38ea1639c617c03bc7adNGRAVE thief Hyperliquid account, XMR1 bought with Bitcoin loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0x04df245cc5d95e47dde3755940974f66d3155757NGRAVE thief Hyperliquid account, XMR1 bought with Bitcoin loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0x05faf1a3d2c07b8d25f1224956e8e377cc0e7ed3NGRAVE thief Hyperliquid account, XMR1 bought with Bitcoin loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0x0e0da478037db1db110dea49d519659f087c177dNGRAVE thief Hyperliquid account, XMR1 bought with Bitcoin loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0x17b79d57824f6b902bf36562efb4e861bcc5f4b4NGRAVE phishing thief collecting wallet, ~$315k (Bitquery investigation; not confirmed by NGRAVE) · Ethereum
address0x180dafda2bb904619af5f41e717fd6af73b98a1bNGRAVE thief swap wallet for Ethereum loot (Bitquery investigation; not confirmed by NGRAVE) · Ethereum
address0x1f5d9e932cb03af8cb0e9dfb2cd0f680b2caa072NGRAVE thief Hyperliquid account, XMR1 bought with Ethereum loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0x2a82fd2a872a9daaf96d743debd7b84e229a9479NGRAVE thief Hyperliquid account, XMR1 bought with Bitcoin loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0x32033e405fd958b1aefa706917508c5dccb9a234NGRAVE thief Hyperliquid account, XMR1 bought with Bitcoin loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0x3692bdba656d140227421a32abb53bd81accb725NGRAVE thief wallet receiving Chainflip payouts for stolen BTC (Bitquery investigation; not confirmed by NGRAVE) · Ethereum
address0x3cc0f5ef802c880788a9d88f8e077c325dfef5b9NGRAVE thief Hyperliquid account, XMR1 bought with Bitcoin loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0x3ce89fa6eaad163d58831b52c72820aad32a483eNGRAVE thief Hyperliquid account, XMR1 bought with Ethereum loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0x40c6c101e5a621028323f2042dd3ceb87b612cd5NGRAVE thief Hyperliquid account, XMR1 bought with Ethereum loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0x46c9fd3348dc18b910ff75179b17947399b86b63NGRAVE thief Hyperliquid account, XMR1 bought with Bitcoin loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0x4831c1d78ca52f5a1c106258694815598c5bc1c1NGRAVE thief Hyperliquid account, XMR1 bought with Bitcoin loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0x517e4b2fefc6225b0803e4e53dec8d829871ccb0NGRAVE thief Hyperliquid account, XMR1 bought with Solana loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0x51a37006e65f3138e88cb033f4cfbc695681765dNGRAVE thief Hyperliquid account, XMR1 bought with Bitcoin loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0x5c004ac24245f99ee8e104e4f9fa5b15119d6072NGRAVE thief Hyperliquid account, XMR1 bought with Bitcoin loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0x6934bf14bcb6d3bd5e3f7e808450b3b52196a847NGRAVE thief Hyperliquid account, XMR1 bought with Ethereum loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0x7314562f742cafda7b6912455d8fb018947a8300NGRAVE thief Hyperliquid account, XMR1 bought with Ethereum loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0x74d5b492d7dcaefdcf4d63c807fbe25e1bcfee66NGRAVE thief Hyperliquid account, XMR1 bought with Bitcoin loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0x7c62dbdea323e480ec8ef713416146e5e75c64abNGRAVE thief Hyperliquid account, XMR1 bought with Bitcoin loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0x8fd4cc19003db3dffb82cb9ca8950c08204e52e9NGRAVE thief Hyperliquid account, XMR1 bought with Bitcoin loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0x946ade0ee77a5d04e0555f7c041a64442e6692c8NGRAVE thief Hyperliquid account, XMR1 bought with Ethereum loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0x951cf04d8d201903f927937698b6579891d34732NGRAVE thief Hyperliquid account, XMR1 bought with Bitcoin loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0x9c1411ae256aa2038eaf66641e7f5abc5731a68bNGRAVE thief Hyperliquid account, XMR1 bought with Bitcoin loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0xa140af0eb11576ab7becc483866f8feb209d9535NGRAVE thief Hyperliquid account, XMR1 bought with Bitcoin loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0xa490fe97b4118980188df2a2c376f541ec67bdc4NGRAVE thief Hyperliquid account, XMR1 bought with Bitcoin loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0xaa084e02bfcab46f433e9ee1a7f997cd7318aeafNGRAVE thief Hyperliquid account, XMR1 bought with Ethereum loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0xbe017e322cd3c35c90b373af4a0ea80b77cdf0f8NGRAVE thief Hyperliquid account, XMR1 bought with Bitcoin loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0xc18cb6c2bbd38defbd5434c1feaf62954cedf485NGRAVE thief Hyperliquid account, XMR1 bought with Bitcoin loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0xc3f9972d68e4239b14a8961dfda52aad85aafa45NGRAVE thief Hyperliquid account, XMR1 bought with Solana loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0xc53b4db03b9450fc6380826e322048400bc14a25NGRAVE thief Hyperliquid account, XMR1 bought with Bitcoin loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0xc8f82e133381b793d6a4e43e147bf5860cbc64c9NGRAVE thief Hyperliquid account, XMR1 bought with Bitcoin loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0xc9d6ba5e3a1b269012661eaf61ea33688590f93aNGRAVE thief Hyperliquid account, XMR1 bought with Bitcoin loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0xdcfd49c1436b2c5f10b845c61100627641b5d907NGRAVE thief Hyperliquid account, XMR1 bought with Bitcoin loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0xdd033cce3e8acc6b41b721ca18652be759cb4268NGRAVE thief Hyperliquid account, XMR1 bought with Bitcoin loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0xe448974cbf8763214508de4c313b92eed9869d5bNGRAVE thief Hyperliquid account, XMR1 bought with Bitcoin loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0xe9aeaef59820d3b103395092f9aa3c741290e652NGRAVE thief Hyperliquid account, XMR1 bought with Solana loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address0xfb2e034e794ede33add413243829668f7ba3f016NGRAVE thief Hyperliquid account, XMR1 bought with Bitcoin loot (Bitquery investigation; not confirmed by NGRAVE) · Hyperliquid
address9jpSiqecXKiufE3Cm1Z7GCRoutq5YMeiNXY6eGtDsijfNGRAVE phishing thief collecting wallet, ~$77k (Bitquery investigation; not confirmed by NGRAVE) · Solana
addressD8DGGQMAabU8BNSaAHgBwhQ7xKcWhJJSRkNGRAVE phishing thief collecting wallet, ~$21k DOGE (Bitquery investigation; not confirmed by NGRAVE) · Dogecoin
addressbc1qtsp4s6mv8536lwnc7zjz87p66k6ldt0g88nl60NGRAVE phishing thief collecting wallet, ~$1.76M BTC (Bitquery investigation; not confirmed by NGRAVE) · Bitcoin
addressrH84ySS9x7UuVwjyByCNThwf2EtJ3w1eNsNGRAVE thief wallet sending stolen XRP to swap service (Bitquery investigation; not confirmed by NGRAVE) · XRP Ledger
addressrpDQgRrAxTVqJ31WpAMDKf2SKgRUynyBoKNGRAVE phishing thief collecting wallet, ~$453k XRP (Bitquery investigation; not confirmed by NGRAVE) · XRP Ledger

OpenPGP-signed. The signed text of this advisory verifies against the 0xCERT key CCC7 D9EC 9415 723D.

Published 2026-10-17 · last updated 2026-10-21

curl -s https://www.0xcert.com/pgp.asc | gpg --import && curl -s https://www.0xcert.com/advisory/0xCERT-2026-0259/signed.txt | gpg --verify