Shortly after midnight on October 18 (Warsaw time), NGRAVE users began receiving push notifications from the official LIQUID companion app claiming their portfolio had been synced on a new device, a Pixel 9 in Moscow. Some also saw a "Security notice" banner inside the app. Both led to a lookalike "Security Center" page that asked for the 24-word recovery phrase or NGRAVE's Perfect Key backup.
NGRAVE confirmed at 00:29 that LIQUID notifications had been hijacked and put the app into maintenance at 02:43. The company says keys never leave the air-gapped ZERO and only LIQUID's notification system was abused. By Sunday evening LIQUID was back, and NGRAVE said it had answered more than 1,000 support tickets, with only a small percentage from users who were actually affected. No loss figure or root cause has been published yet.
Why it matters
The alert arrived through a trusted channel, with the real app's name and icon, so checking the sender was not enough. The request itself was the red flag. It follows a run of attacks on hardware wallet users that target the channels around the device rather than the device itself.
What to do
No legitimate wallet vendor will ever ask for your recovery phrase, in an app, by email or on a website. If you entered your seed or Perfect Key, treat it as compromised: move funds to a new wallet with a fresh seed and contact NGRAVE support via ngrave.io. If you only tapped the link and typed nothing, NGRAVE says you are safe.