NGRAVE LIQUID Fake Alert Drains Wallets

Attackers used the push notifications of NGRAVE’s LIQUID wallet app to send owners a fake security alert on 17 October, leading them to a copy of NGRAVE’s website that asked for their recovery phrase. NGRAVE’s incident report says anyone who entered one “had their wallet emptied within minutes”. Blockchain data firm Bitquery estimates that $2.65m was taken.

The attack did not break NGRAVE’s ZERO hardware wallet. Instead it turned a trusted app into a phishing channel, persuading people to type in the one secret the device exists to protect. That matters for every self-custody user: a hardware wallet is only as safe as the recovery words, and here the request came from the wallet maker’s own app.

In brief

NGRAVE says attackers hijacked the access of a third-party provider that sends LIQUID’s push notifications and sent a fake security alert on 17 October.
Victims typed their recovery phrase or Perfect Key into a phishing page; NGRAVE says its ZERO devices and private keys were not breached.
Bitquery estimates $2.65m was taken from 84 wallets, but says it cannot prove every wallet belonged to an NGRAVE owner; NGRAVE has traced at least $2.56m.

How the fake alert worked

According to NGRAVE, “On 17 October, attackers hijacked the access of a third-party provider that sends LIQUID’s push notifications, and sent a fake security alert.” The message arrived at about 21:30 UTC (22:30 BST) and read: “Security alert. Your LIQUID portfolio was synced on a new device — Pixel 9, Moscow (today, 21:30). If this wasn’t you, review now.” NGRAVE has not named the provider.

The alert opened a convincing copy of NGRAVE’s website with a “Was this you?” screen, a countdown and a Deny button, the company says. Pressing Deny led to a page asking for the user’s Perfect Key, NGRAVE’s own form of backup key, or 24-word recovery phrase. Anyone who entered either gave the attacker full control of their wallet, and automated scripts emptied it within minutes, according to the report.

The attackers took one access key and used it to obtain a second, more powerful one, NGRAVE says, with the earliest sign of access dating from 11 October. It cut off the first key at 21:40 UTC (22:40 BST), but alerts kept arriving until it shut down all notification sending at 22:45 UTC (23:45 BST). The first wallet was emptied at 21:36 UTC and the last theft NGRAVE has traced was at 03:51 UTC (04:51 BST) on 18 October.

Loss estimates differ

The two counts of the damage do not match. Bitquery says $2.65m was “Taken from 84 wallets on six chains in about six hours, after fake alerts in NGRAVE’s LIQUID app.” NGRAVE says it has traced “about $2.56 million, taken from about 70 wallet addresses on four networks, at 17 October prices”, and calls that “a minimum”.

Measure	Bitquery (estimate)	NGRAVE (own tracing)
Amount taken	$2.65m	About $2.56m (minimum)
Wallets	84	About 70 addresses
Networks	Six chains	Four networks

Source: Bitquery investigation and NGRAVE incident report, both 19 October 2026.

Bitquery adds an important caveat: “The record cannot prove that every one of those wallets belonged to an NGRAVE owner.” It ties the wallets to the fake alerts through timing, two victims’ posts on X and the unusual scale of activity that night. According to Bitquery, $2.16m was “Turned into XMR1, a Monero token, in 39 new Hyperliquid accounts. None of it had moved by 09:00 UTC on 19 October.” It says “12 swaps” “Took the Bitcoin through Chainflip.”

The device held, the data did not

NGRAVE stresses that “The LIQUID app’s code and your ZERO’s secrets were not breached.” Bitquery agrees that “Nothing in the record shows a break in the ZERO itself.” But NGRAVE says the attackers copied a notification list on 17 October that includes phone model, country, time zone, usage data and possibly IP address. It warns that this could help link wallet addresses to locations, making targeted scams more likely, and is reporting the exposure to the Belgian Data Protection Authority.

According to Bitquery, NGRAVE took LIQUID offline that night and restored it the next evening, by which time it had answered “over 1,000 support tickets”. NGRAVE says LIQUID will now only open links to its own official sources, with two people approving every notification. In a note in the report, the company’s chief executive wrote: “In this, we have absolutely and utterly failed.”

NGRAVE may not be the only target. Bitquery says that a day earlier, on 16 October, “SecuX owners were sent fake links through the SecuX app in the same way,” though it found “no on-chain link” between those thefts and the NGRAVE thief.

Our read

This is TSN’s analysis, not investment advice. The weak point here was the notification supply chain, not the hardware. If Bitquery’s tracing holds, funds parked in identifiable Hyperliquid accounts give exchange compliance teams a narrow window to act before any conversion to Monero. For users, the rule holds: no genuine app will ever ask for a recovery phrase.