NGRAVE Users Lose $2.65 Million in New Phishing Campaign

A serious NGRAVE phishing attack has led to the theft of roughly $2.65 million in digital assets from hardware wallet owners. On-chain investigators tracking the incident observed attackers siphoning funds from compromised accounts and funneling the proceeds through decentralized trading venues, highlighting the persistent threats facing self-custody participants.

According to blockchain analytics firm Bitquery, as reported by CryptoSlate, the illicit capital was rapidly converted into privacy-focused assets, including purchases of XMR1 instruments on the Hyperliquid decentralized exchange. While tracing tools successfully followed the token transfers to the execution layer, researchers noted that confirming whether every single impacted address belonged exclusively to an NGRAVE device owner remains technically challenging due to transaction obfuscation.

Hardware wallet manufacturers have increasingly become prime targets for social engineering campaigns rather than direct firmware exploits. Criminals frequently deploy counterfeit web interfaces, deceptive email alerts, and malicious browser extensions to trick users into revealing their secret recovery phrases, bypassing even the most robust physical device protections.

Security specialists caution that as hardware security modules improve, malicious actors will continue to shift focus toward psychological manipulation. The incident raises fresh questions about user education and transaction verification interfaces, as investors must navigate increasingly sophisticated deceptive techniques targeting personal seed phrases.

Market participants and device owners are advised to remain vigilant against unexpected communication prompting mnemonic entry. Observers are monitoring whether further tracing will identify the perpetrators or if additional addresses were swept up in the same credential harvesting infrastructure.