App de carteira NGRAVE LIQUID · Breach

NGRAVE report: fake LIQUID app alerts stole $2.56 million

Oct 10, 2026 · 2 min read

Attackers gained access to a third-party notification provider for NGRAVE's LIQUID app and sent fake alerts on 17 October 2026 leading to a counterfeit site asking for the 24-word recovery phrase. NGRAVE estimates $2.56 million stolen from roughly 70 addresses; Bitquery counts $2.65 million across 84 wallets, with $2.16 million in a Monero token on Hyperliquid unmoved as of 19 October. NGRAVE closed the compromised access, replaced keys, and asked exchanges and bridges to freeze the funds; the ZERO hardware wallet was not breached and the recovery phrase must never be typed into websites.

By HIFY Radar newsroom Updated 10/26/2026 01:34 PM Get this every day →← Back to the feed 3 sources

HighBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Attackers gained access to a third-party provider that sends notifications for NGRAVE's LIQUID app and pushed fake alerts on the evening of 17 October. The alerts led to a counterfeit NGRAVE site asking for the 24-word recovery phrase; users who typed it had their wallets emptied within minutes. NGRAVE estimates $2.56 million stolen from roughly 70 addresses.

Why it matters

The scam reached ZERO hardware wallet users through the official companion app, exploiting trust in the brand. An on-chain count by Bitquery puts losses at $2.65 million across 84 wallets on six networks, with $2.16 million already in a Monero-tracking token on Hyperliquid. Per NGRAVE, the ZERO hardware wallet, stored private keys, and app code were not breached.

What to do

Reinforce to customers that the recovery phrase must never be typed into websites; per NGRAVE, users who only opened the link lost nothing. NGRAVE has closed the compromised access, replaced keys on its live systems, and asked exchanges and bridges to freeze stolen funds. Review every third-party provider that sends messages in the company's name and restrict links to official domains.

For the technical team

Affected: App de carteira NGRAVE LIQUID (provedor de notificações push) · LIQUID app, companion to NGRAVE's ZERO hardware wallet. Per the company, the ZERO, stored private keys, and LIQUID app code were not breached. Victims: users who typed their recovery phrase into the fake site on the night of 17 October 2026.
Exploitation: Confirmed exploitation. First wallet emptied at 21:36 UTC on 17 October, before the first public warning; the last shortly before 04:00 UTC. Bitquery counts $2.65 million from 84 wallets on six networks in about six hours; 81% became XMR1 on Hyperliquid. NGRAVE estimates $2.56 million from roughly 70 addresses, a minimum at 17 October prices. Bitquery reports an identical scam against SecuX users on 16 October, one day earlier.
Fix: No patch. NGRAVE took LIQUID offline on the night of 17 October and restored it the next evening, closed the provider's compromised access, replaced keys used by live systems, asked exchanges and bridge services to freeze stolen funds, and plans to restrict LIQUID links to official company sites.
Vector: Compromise of a third-party push-notification provider for the LIQUID app. Attackers sent fake alerts through the app itself (a claimed wallet sync on a Pixel 9 in Moscow) to a counterfeit site with a timer and a deny button that asked for the 24-word recovery phrase (Perfect Key). One phrase opens the wallets on every chain the ZERO supports; typing the words is what caused the losses, per NGRAVE.
More details: Bitquery ties the thefts to one thief: 15 bursts with wallets emptied on two or more chains within two minutes, the last at 03:12 UTC (XRP, Ethereum, Solana, and Stellar within 90 seconds). The XRP and Ethereum collectors were first funded on 8 October, three minutes apart. $2.16M in XMR1 had not moved as of 09:00 UTC on 19 October. On-chain records cannot prove all 84 wallets belonged to NGRAVE users; two loss reports on X match 21,810 XRP and 4,000 XRP. First public warning on X just after 22:00 UTC on 17 October; NGRAVE confirmed within half an hour and answered over 1,000 support tickets.