{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "NGRAVE LIQUID push notifications hijacked to phish wallet recovery phrases · updates",
  "home_page_url": "https://pwn.watch/i/ngrave-liquid-fake-push-alert-phishing",
  "feed_url": "https://pwn.watch/i/ngrave-liquid-fake-push-alert-phishing/feed.json",
  "description": "On Oct 17 2026 attackers who had taken over access to the third-party provider that sends push notifications for NGRAVE's LIQUID wallet app sent users a fake security alert. It led to a copy of NGRAVE's website asking for the 24-word recovery phrase or Perfect Key, and anyone who entered one had their wallet drained within minutes. NGRAVE says the LIQUID app code and ZERO hardware wallets were not breached. Losses are estimated at roughly $2.56M to $2.65M.",
  "language": "en",
  "_pwn": {
    "slug": "ngrave-liquid-fake-push-alert-phishing",
    "severity": "high",
    "status": "live",
    "patchStatus": "no-fix-needed",
    "rss": "https://pwn.watch/i/ngrave-liquid-fake-push-alert-phishing/feed.xml",
    "llms": "https://pwn.watch/i/ngrave-liquid-fake-push-alert-phishing/llms.txt",
    "json": "https://pwn.watch/i/ngrave-liquid-fake-push-alert-phishing.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/ngrave-liquid-fake-push-alert-phishing#2026-10-19-9312cf11",
      "url": "https://pwn.watch/i/ngrave-liquid-fake-push-alert-phishing#2026-10-19-9312cf11",
      "title": "NGRAVE LIQUID push notifications hijacked to phish wallet recovery phrases: NGRAVE publishes its incident report: the LIQUID app code and ZERO hardware wallets were not breached. TokenPost reports NGRAVE traced about $2.56M from roughly 70 addresses; Bitquery's on-chain trace counts $2.65M from 84 wallets, mostly swapped into a Monero-tracking token on Hyperliquid.",
      "content_text": "NGRAVE LIQUID push notifications hijacked to phish wallet recovery phrases: NGRAVE publishes its incident report: the LIQUID app code and ZERO hardware wallets were not breached. TokenPost reports NGRAVE traced about $2.56M from roughly 70 addresses; Bitquery's on-chain trace counts $2.65M from 84 wallets, mostly swapped into a Monero-tracking token on Hyperliquid.\n\nSource: https://www.ngrave.io/en/blog/incident-report-fake-liquid-security-alert-17-october",
      "date_published": "2026-10-19T00:00:00.000Z",
      "external_url": "https://www.ngrave.io/en/blog/incident-report-fake-liquid-security-alert-17-october",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/ngrave-liquid-fake-push-alert-phishing#2026-10-17-7815a8d3",
      "url": "https://pwn.watch/i/ngrave-liquid-fake-push-alert-phishing#2026-10-17-7815a8d3",
      "title": "NGRAVE LIQUID push notifications hijacked to phish wallet recovery phrases: About 21:30 UTC: fake 'synced on a new device, Pixel 9, Moscow' alert pushed to LIQUID users, linking to a copy of NGRAVE's site asking for the recovery phrase or Perfect Key. NGRAVE cut the first key by 21:40 UTC; wallets of people who entered a phrase were emptied within minutes.",
      "content_text": "NGRAVE LIQUID push notifications hijacked to phish wallet recovery phrases: About 21:30 UTC: fake 'synced on a new device, Pixel 9, Moscow' alert pushed to LIQUID users, linking to a copy of NGRAVE's site asking for the recovery phrase or Perfect Key. NGRAVE cut the first key by 21:40 UTC; wallets of people who entered a phrase were emptied within minutes.\n\nSource: https://www.ngrave.io/en/blog/incident-report-fake-liquid-security-alert-17-october",
      "date_published": "2026-10-17T00:00:00.000Z",
      "external_url": "https://www.ngrave.io/en/blog/incident-report-fake-liquid-security-alert-17-october",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/ngrave-liquid-fake-push-alert-phishing#2026-10-11-c8eecaf3",
      "url": "https://pwn.watch/i/ngrave-liquid-fake-push-alert-phishing#2026-10-11-c8eecaf3",
      "title": "NGRAVE LIQUID push notifications hijacked to phish wallet recovery phrases: Earliest sign NGRAVE found of attacker access to LIQUID's third-party push-notification provider.",
      "content_text": "NGRAVE LIQUID push notifications hijacked to phish wallet recovery phrases: Earliest sign NGRAVE found of attacker access to LIQUID's third-party push-notification provider.\n\nSource: https://www.ngrave.io/en/blog/incident-report-fake-liquid-security-alert-17-october",
      "date_published": "2026-10-11T00:00:00.000Z",
      "external_url": "https://www.ngrave.io/en/blog/incident-report-fake-liquid-security-alert-17-october",
      "tags": [
        "high"
      ]
    }
  ]
}