NGRAVE LIQUID fake security alerts hack — October 2026

NGRAVE is a Belgian maker of the ZERO hardware wallet, which comes with a phone app called LIQUID. At 21:30 UTC on 17 October 2026 owners received a LIQUID notification saying their portfolio had been synced on a new device. It led to a page with a “deny” button and then a request for their recovery phrase. According to NGRAVE’s incident report, the attackers had hijacked a third-party provider’s access to LIQUID’s push notifications: they took one access key, used it to obtain a second, more powerful one, and had first shown signs of access on 11 October. NGRAVE warned users within the hour, cut off the keys and shut down all notification sending by 22:45 UTC.

Owners who typed their recovery words lost everything those words controlled. NGRAVE traced about $2.56 million taken from about 70 wallet addresses on four networks, at 17 October prices, and called that a minimum. The first wallet was emptied at 21:36 UTC and the last traced theft came at 03:51 UTC on 18 October. Bitquery counted $2.65 million from 84 wallets on six chains, the upper end here, and found most of it converted into a Monero-tracking token on Hyperliquid. NGRAVE says the ZERO device and the LIQUID code were not compromised.

NGRAVE said it was working with every affected person directly but did not commit to compensation, and nothing has been reported as recovered.