NGRAVE LIQUID push notifications hijacked to phish wallet recovery phrases
NGRAVE LIQUID wallet app (push-notification provider)
On Oct 17 2026 attackers who had taken over access to the third-party provider that sends push notifications for NGRAVE's LIQUID wallet app sent users a fake security alert. It led to a copy of NGRAVE's website asking for the 24-word recovery phrase or Perfect Key, and anyone who entered one had their wallet drained within minutes. NGRAVE says the LIQUID app code and ZERO hardware wallets were not breached. Losses are estimated at roughly $2.56M to $2.65M.
Why this severity: Vendor push channel hijacked; about $2.6M drained from users who entered recovery phrases
- Started
- Oct 11, 2026
Affected
Not published yet
Fixed in
No fixed release yet
Timeline3
NGRAVE publishes its incident report: the LIQUID app code and ZERO hardware wallets were not breached. TokenPost reports NGRAVE traced about $2.56M from roughly 70 addresses; Bitquery's on-chain trace counts $2.65M from 84 wallets, mostly swapped into a Monero-tracking token on Hyperliquid.
About 21:30 UTC: fake 'synced on a new device, Pixel 9, Moscow' alert pushed to LIQUID users, linking to a copy of NGRAVE's site asking for the recovery phrase or Perfect Key. NGRAVE cut the first key by 21:40 UTC; wallets of people who entered a phrase were emptied within minutes.
Earliest sign NGRAVE found of attacker access to LIQUID's third-party push-notification provider.
Advisories1
News & write-ups2
Notes & caveats
Loss figures differ by source: TokenPost cites NGRAVE's trace (about $2.56M, ~70 addresses); Bitquery's on-chain trace says $2.65M from 84 wallets. Nothing to patch; only users who typed a phrase need to act.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
