Incident report: the fake LIQUID security alert of 17 October

On the evening of 17 October, LIQUID users received a fake security alert. Attackers hijacked the access of a third-party provider that sends LIQUID's push notifications. That is why the alert looked like a real message from us. It led to a copy of our website that asked for your recovery phrase or Perfect Key. Anyone who entered one had their wallet emptied within minutes.

The LIQUID app's code and your ZERO's secrets were not breached. Your private keys never leave your ZERO, and the attacker could not reach them.

We're sorry to everyone affected. If you lost funds, we know an apology doesn't bring them back. We're working with every affected person directly, and we'll keep you informed as we learn more.

This post explains what happened, where the stolen funds went and what we're changing. If you entered your recovery phrase or Perfect Key on that site, please start with the steps below. A note from our CEO at the end.

What to do now

Please find the situation that matches yours:

• You typed your recovery phrase or Perfect Key into the site. Treat that wallet as unsafe on every network, even if it still looks untouched. Move what's left to a new wallet with a new recovery phrase, and don't send anything to the old addresses again. This applies even if the site said your phrase was wrong, or you typed only part of it.
• You only opened the link or tapped its buttons. Your funds are safe. The site could only steal what was typed into it. If you added a web app called "NGRAVE Security Center" to your home screen, please delete it. It isn't ours.
• You never saw the alert. Your funds were not taken in this attack. Please still read the next two points.
• Your ZERO device was not breached. The attacker never had access to any ZERO device or the keys stored on it. They could only use the phrases and Perfect Keys people typed into the fake site.
• Please be careful with messages in the coming weeks. If you opened LIQUID around the time of the attack, the attacker may know which wallet addresses are yours. NGRAVE will never ask for your recovery phrase, your Perfect Key or a payment. Anyone who offers to "recover" stolen crypto for a fee is a scammer.

If you're not sure which of these applies to you, write to us at support@ngrave.io and we'll help you check.

What happened

At about 21:30 UTC on 17 October, LIQUID users received this push notification, and the same message appeared as a banner inside the app:

The message was designed to create urgency, and it arrived through the same service as our real notifications. If you tapped it, you did nothing wrong.

How the attacker got in. Attackers hijacked the access of a third-party provider that sends LIQUID's push notifications. They took one access key, then used it to get a second, more powerful one. With it, they could send messages to LIQUID users and read some of LIQUID's analytics data, such as total amounts and the number of people synced. The earliest sign of this access we've found is from 11 October.

How the scam worked. The alert led to a malicious website, a convincing copy of our website. It showed a "Was this you?" screen with a countdown and a Deny button. Pressing Deny opened a page asking for your Perfect Key or 24-word recovery phrase, presented as the step that would block the intruder. Anyone who entered either one gave the attacker full control of their wallet, and automated scripts emptied it within minutes.

How long it lasted. Our team received the alert too and raised it within a minute. We cut off the first key by 21:40 UTC, but alerts kept arriving through the second key until we shut down all notification sending at 22:45 UTC. Thefts continued for some hours afterwards, from wallets whose phrases had already been entered. The last one we've traced was at 03:51 UTC on 18 October.

Timeline

All times are UTC.

Where the stolen funds went

So far we've traced about $2.56 million, taken from about 70 wallet addresses on four networks, at 17 October prices. We're working with each affected person individually. This is a minimum: we're still checking other networks and matching reports from customers.

Where the stolen funds went, from customers' wallets to where the funds are now. Source: NGRAVE on-chain tracing, 19 October 2026.

• Bitcoin, $1.77M. Collected in one attacker address, then split across 12 new addresses. We're tracing each one.
• XRP, $454k. Paid into the exchange ChangeNOW in 54 deposits within hours. We're asking ChangeNOW to freeze them.
• Ethereum, $316k. The stolen tokens were sold for ETH, and all 130.47 ETH was then moved to other blockchains through LI.FI, a service that moves crypto from one blockchain to another. About $2,900 in tokens the attacker didn't sell is still in their wallet.
• Stellar, $18k. Sent to what looks like an exchange deposit address. We're identifying the service.

We're sharing every attacker address and transaction with law enforcement. We're also asking exchanges and bridge operators to freeze funds and identify who holds them. Exchanges usually act only on a police report, which is why we ask affected customers to file one.

What the attacker could see

The second key also let the attacker read some of LIQUID's analytics data, and change some of it. We're checking whether they changed anything, for example to show the fake banner inside the app. We're still reviewing the full extent, and we'll update this post as we learn more.

Here is what they could reach:

• Notification list. Copied by the attacker on 17 October. One entry per phone: a notification token, phone model and operating system, LIQUID version, language, country, time zone, usage data and an internal app ID. It may also include IP address and approximate location.
• Swap history. Could be read; we're checking whether it was copied. Crypto addresses, amounts and times of swaps made in LIQUID, plus recent balance data.
• App usage data. Could be read; we're checking whether it was copied. Device, LIQUID and ZERO versions, IP address and general location.
• Data-deletion requests. Could be read; we're contacting these people directly. Email address and order number for a small number of customers who used our data-deletion form.

What they could not reach: your name and shipping address, which are kept in a separate system; your ZERO device; your private keys; your recovery phrase and Perfect Key.

For people who opened LIQUID around the time of the attack, this data could let the attacker link their wallet addresses and amounts to their IP address and approximate location, which makes targeted scams more likely. If a message about this incident asks you to act, please check with us first. We're reporting the exposure to the Belgian Data Protection Authority.

What we have done

As soon as we saw the fake alert, our whole team worked to stop it and to help the people affected. So far we have:

• Shut down the notification service and removed the fake messages
• Reported the phishing website for takedown
• Preserved all relevant logs and reported the incident to the authorities
• Asked exchanges and bridge services to freeze the stolen funds
• Answered every support ticket, and our CEO has contacted every affected user individually

What we're changing

We have closed the access the attacker used, replaced every key our live systems use and shut down the routes the attacker used. These changes come next, and we'll update this list as each one is done:

• LIQUID will only open links to NGRAVE's own official sources. Notifications, banners and in-app messages won't be able to open any other website, so a message like the fake alert can't send you to a copycat site.
• A notification key that can send messages and nothing else
• Notification access limited to our own servers, with two-factor sign-in
• Alerts for unusual use, bulk exports and any message sent outside our approval process
• Two people must approve every notification and in-app message
• Short-lived keys, replaced at least every 90 days
• One switch that shuts down every notification route at once
• A review of whether we need to keep swap history at all
• A full review of what else the stolen keys could reach

If you lost funds

We're sorry you're dealing with this. Here's how we can help, step by step:

1. Move what's left. Set up a new wallet with a new recovery phrase, and move any remaining funds to it on every network. Our getting started guide walks you through it.
2. Contact us at support@ngrave.io if you haven't yet. You'll get a case number starting with OSH, and one person on our team as your contact.
3. Send us what helps us trace your funds: transaction IDs, your wallet addresses, the addresses your funds went to, and roughly when you entered your phrase. Never send us your old or new recovery phrase.
4. File a police report where you live, and share the reference number with us. Exchanges usually won't freeze funds without one.
5. Ignore anyone who offers to recover your crypto for a fee. They are scammers, even when they say they work with NGRAVE.

If you'd rather talk to someone than write, reply to your case and ask for a call. We'll arrange one.

Updates

We'll update this post as the investigation continues, including any funds that are frozen or recovered. Last updated 19 October 2026.

Thank you to everyone who spotted the alert, warned others and stayed patient with our team while we answered your messages.

A note from our CEO

Hello everyone,

The past few days have been unkind, to say the least. Put simply, our internal notification system was infiltrated by sophisticated attackers, who used access keys with far more power than they needed to send phishing links. The notifications sent users to a fake website, and anyone who entered their recovery phrase or Perfect Key there had their wallet emptied straight away. A classic trick, and one that we at NGRAVE should have prevented.

In my humble opinion, the first duty of a crypto security company is to provide exactly that: security. In this, we have absolutely and utterly failed.

Since I stepped into the role of CEO a few months ago, we've started a great many initiatives, many of which you will soon see in public. On security, I judged our posture inadequate when I joined, and so it became a top priority for the company. But a complete rebuild of our security systems, bringing our methods up to the state of the art and hardening our defences, takes months, and sadly we could not finish it in time.

For now, I can only apologise to those affected. Moving forward, I promise that we will double, triple and quadruple our efforts to improve the security of the company, our systems and, ultimately, the barrier between your funds and the attackers looking to steal them. Part of this is transparency. Soon you will see part of our security roadmap and the new measures we're putting in place, and get a fuller view of our commitment to this core part of the company. In the meantime, we're working with the proper authorities, tracing whatever funds we can and working directly with those affected. Our aim is to be the most secure company in the world, and we are a far cry from that today. But with courage, faith, perspicacity and time, I believe it is possible.

Watch this space,

R

A reminder we have always stood by

Never share your recovery phrase or Perfect Key with anyone. Not with a website, not with an app, and not with us. NGRAVE will never ask for it. This incident is exactly why this rule will never change.