NGRAVE LIQUID phishing via hijacked push notifications

About $2.56 million from about 70 wallet addresses on four networks at 17 October prices, described by NGRAVE as a minimum. Secondary figure disagrees: Bitquery says $2.65M from 84 wallets.

Root cause: Per NGRAVE: attackers took one notification-provider access key, used it to obtain a second, more powerful key, and could then message all LIQUID users and read some analytics data. App code and ZERO device secrets were not breached.

Timeline, as sourced: 17 Oct 2026, fake alert at about 21:30 UTC; last traced theft 18 Oct 2026 03:51 UTC; NGRAVE incident report 19 Oct 2026.

On the evening of 17 October 2026, users of NGRAVE's LIQUID app received a fake security alert claiming their portfolio had been synced on a new device. According to NGRAVE's incident report (opens in a new tab), attackers hijacked the access of a third-party provider that sends LIQUID push notifications, taking one access key and using it to obtain a second, more powerful one. The alert led to a copy of NGRAVE's website that asked for a recovery phrase or Perfect Key, and wallets whose secrets were entered were emptied by automated scripts. NGRAVE says the app's code and ZERO device secrets were not breached. It has traced about $2.56 million taken from about 70 addresses on four networks, at 17 October prices, and describes that figure as a minimum.