# NGRAVE LIQUID push notifications hijacked to phish wallet recovery phrases · pwn.watch > On Oct 17 2026 attackers who had taken over access to the third-party provider that sends push notifications for NGRAVE's LIQUID wallet app sent users a fake security alert. It led to a copy of NGRAVE's website asking for the 24-word recovery phrase or Perfect Key, and anyone who entered one had their wallet drained within minutes. NGRAVE says the LIQUID app code and ZERO hardware wallets were not breached. Losses are estimated at roughly $2.56M to $2.65M. Page: https://pwn.watch/i/ngrave-liquid-fake-push-alert-phishing · generated 2026-10-25T11:56:53.269Z ## Status - Severity: high · status: live · patch: no-fix-needed - Product: NGRAVE LIQUID wallet app (push-notification provider) - Started: 2026-10-11 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/ngrave-liquid-fake-push-alert-phishing/feed.xml - JSON Feed: https://pwn.watch/i/ngrave-liquid-fake-push-alert-phishing/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/ngrave-liquid-fake-push-alert-phishing.json - This file: https://pwn.watch/i/ngrave-liquid-fake-push-alert-phishing/llms.txt ## Updates (newest first) - 2026-10-19: NGRAVE publishes its incident report: the LIQUID app code and ZERO hardware wallets were not breached. TokenPost reports NGRAVE traced about $2.56M from roughly 70 addresses; Bitquery's on-chain trace counts $2.65M from 84 wallets, mostly swapped into a Monero-tracking token on Hyperliquid. (https://www.ngrave.io/en/blog/incident-report-fake-liquid-security-alert-17-october) - 2026-10-17: About 21:30 UTC: fake 'synced on a new device, Pixel 9, Moscow' alert pushed to LIQUID users, linking to a copy of NGRAVE's site asking for the recovery phrase or Perfect Key. NGRAVE cut the first key by 21:40 UTC; wallets of people who entered a phrase were emptied within minutes. (https://www.ngrave.io/en/blog/incident-report-fake-liquid-security-alert-17-october) - 2026-10-11: Earliest sign NGRAVE found of attacker access to LIQUID's third-party push-notification provider. (https://www.ngrave.io/en/blog/incident-report-fake-liquid-security-alert-17-october) ## Fix brief # Security brief: NGRAVE LIQUID push notifications hijacked to phish wallet recovery phrases Source: https://pwn.watch/i/ngrave-liquid-fake-push-alert-phishing · status: live · severity: high · updated Oct 25, 2026, 09:11 UTC ## Patch status **NO FIX NEEDED: no action on your side beyond verification.** ## What it is On Oct 17 2026 attackers who had taken over access to the third-party provider that sends push notifications for NGRAVE's LIQUID wallet app sent users a fake security alert. It led to a copy of NGRAVE's website asking for the 24-word recovery phrase or Perfect Key, and anyone who entered one had their wallet drained within minutes. NGRAVE says the LIQUID app code and ZERO hardware wallets were not breached. Losses are estimated at roughly $2.56M to $2.65M. Severity detail: Vendor push channel hijacked; about $2.6M drained from users who entered recovery phrases - Product: NGRAVE LIQUID wallet app (push-notification provider) ## Affected versions - Not specified in the data. Check the advisories below. ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes If you typed your NGRAVE recovery phrase or Perfect Key into any page around Oct 17 2026, treat it as stolen on every chain: move remaining funds to a new wallet with a new recovery phrase and never send to the old addresses. If you only tapped the alert, NGRAVE says funds are safe; delete any home-screen web app named 'NGRAVE Security Center'. NGRAVE never asks for a recovery phrase. ## Latest updates - Oct 19, 2026: NGRAVE publishes its incident report: the LIQUID app code and ZERO hardware wallets were not breached. TokenPost reports NGRAVE traced about $2.56M from roughly 70 addresses; Bitquery's on-chain trace counts $2.65M from 84 wallets, mostly swapped into a Monero-tracking token on Hyperliquid. - Oct 17, 2026: About 21:30 UTC: fake 'synced on a new device, Pixel 9, Moscow' alert pushed to LIQUID users, linking to a copy of NGRAVE's site asking for the recovery phrase or Perfect Key. NGRAVE cut the first key by 21:40 UTC; wallets of people who entered a phrase were emptied within minutes. - Oct 11, 2026: Earliest sign NGRAVE found of attacker access to LIQUID's third-party push-notification provider. ## Advisories - [Incident report: the fake LIQUID security alert of 17 October](https://www.ngrave.io/en/blog/incident-report-fake-liquid-security-alert-17-october) (NGRAVE) ## Write-ups & news - [NGRAVE Hack: $2.65M Stolen, $2.16M Now in a Monero Token](https://bitquery.io/investigations/ngrave-liquid-hack) - [NGRAVE Traces $2.56 Million in Losses From Fake LIQUID Alerts](https://www.tokenpost.com/news/technology/36542) ## Caveats Loss figures differ by source: TokenPost cites NGRAVE's trace (about $2.56M, ~70 addresses); Bitquery's on-chain trace says $2.65M from 84 wallets. Nothing to patch; only users who typed a phrase need to act. --- Machine-readable: https://pwn.watch/i/ngrave-liquid-fake-push-alert-phishing.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.