Hijacked NGRAVE push notifications lead to $2.56M phishing theft
Who is affected
LIQUID users who followed the fake alert and entered their recovery phrase or Perfect Key lost funds, about $2.56 million by NGRAVE's count; app usage data of other users was also exposed. NGRAVE states its ZERO devices and their keys were not compromised.
What happened
On the evening of 17 October 2026 users of NGRAVE’s LIQUID companion app received a push notification and in-app banner claiming their portfolio had been synced on a new device, a Pixel 9 in Moscow according to press reports. NGRAVE published an incident report on 19 October.
According to NGRAVE, attackers hijacked the access of the third-party provider that sends LIQUID’s notifications, using one access key to obtain a second, more powerful one; the earliest sign of access dates from 11 October. The alert led to a copy of NGRAVE’s website whose Deny button asked for the Perfect Key or 24-word recovery phrase; anyone who entered either lost control of the wallet, and NGRAVE says automated scripts emptied wallets within minutes. NGRAVE states that the ZERO devices, their private keys, the LIQUID app code and customer names and addresses were not compromised, but that the attackers copied the notification list (device, OS, language, country and possibly IP-based location) and could read swap history and usage data.
NGRAVE says it spotted the alert at 21:31 UTC, the first wallet was emptied at 21:36, sending was fully shut down at 22:45, the last theft was traced at 03:51 on 18 October and every key used by live systems was replaced by 09:37. It reported the phishing site, asked exchanges and bridges to freeze funds, involved authorities and notified the Belgian data protection authority, and lists planned controls such as two-person approval for messages and a single shutdown switch. According to Bitcoin.com News, NGRAVE’s CEO acknowledged that the company had failed in its core security duty.
What NGRAVE advises:
- If you entered your recovery phrase or Perfect Key on the fake site, treat that wallet as unsafe on every network and move remaining funds to a new wallet with a new recovery phrase.
- If you only opened the link, your funds are safe; delete any “NGRAVE Security Center” web app from your home screen.
- Never share your recovery phrase or Perfect Key; NGRAVE will never ask for it.
A companion app is a software application used to manage and interact with cryptocurrency wallets or blockchain networks, typically offering features like transactions and security controls.
Read full definitionA mnemonic phrase is a set of words that stores a cryptocurrency wallet's private keys, allowing users to recover access if lost.
Read full definitionA private key is the secret number that proves ownership of a crypto address and signs its transactions. Whoever has it controls the funds.
In cryptocurrency, a swap is the direct exchange of one token for another on a blockchain, often via decentralized exchanges (DEXs) without intermediaries.
A crypto exchange is a company that lets users buy, sell and trade crypto and, by default, holds the keys to their coins.
Read full definitionA bridge in blockchain allows assets or data to move between different blockchains, enabling interoperability between otherwise separate networks.
Read full definitionBitcoin (BTC) is the first decentralized cryptocurrency, launched in 2009. It uses blockchain technology for secure, peer-to-peer digital transactions without intermediaries.
Read full definitionRecovery is the process of restoring access to a cryptocurrency wallet using its seed phrase or mnemonic backup if the original wallet is lost or inaccessible.
Read full definitionSources
Independent reporting and research this entry was checked against.
Learn more
Guides on protecting yourself against this type of incident (Vendor infrastructure compromise) and the glossary terms that describe it.
How to Avoid Phishing Attacks
Phishing is the #1 way people lose crypto. Learn to spot fake emails, websites, and apps before they steal your funds.
Read GuidePhishing Defense: Protecting Your Hardware Wallet from Social Engineering
Fake websites, spoofed emails, malicious dApps — how phishing attacks target hardware wallet users and how to spot them every time.
Read GuidePhishing Attack
A phishing attack tricks crypto users into revealing private keys, seed phrases, or login details via fake emails, websites, or messages mimicking legitimate wallets or exchanges.
Malware
Malware is malicious software that steals or redirects crypto, for example by logging keystrokes, swapping copied addresses or reading wallet files.
Cite this entry
WalletInsights. “Hijacked NGRAVE push notifications lead to $2.56M phishing theft”. Hardware wallet security incident tracker. Last verified November 3, 2026. https://walletinsights.io/en/security-incidents/ngrave-liquid-push-notification-phishing-2026/
Corrections and right of reply
Vendors, researchers and readers can send corrections or statements to security@walletinsights.io. We check them against the sources, update the entry and record the change in its log.