Skip to content
NGRAVE LIQUID App Hack Results in $2.65M Theft

NGRAVE LIQUID App Hack Results in $2.65M Theft

First seen 20 Oct 2026, 18:11 UTC •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 20, 2026 at 19:16 UTC
  • •Attackers exploited third-party notifications to send fake alerts.
  • •Approximately $2.65 million stolen from 84 wallets across six chains.
  • •Similar attacks were reported against SecuX users just days prior.

On October 17, 2026, attackers exploited a third-party service to send fake security alerts through the NGRAVE LIQUID app, leading to the theft of $2.65 million from 84 wallets across six blockchain networks. The attackers hijacked push notifications, tricking users into entering their recovery phrases. The stolen funds were quickly converted into Monero and other cryptocurrencies through various exchanges. The incident highlights a significant security lapse, as similar attacks were reported against SecuX users shortly before. NGRAVE is investigating the breach and advising users on protective measures. As of October 19, no stolen funds had been moved from the new accounts created by the attackers.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-17
Fake alerts sent via LIQUID app
Attackers hijacked a third-party service to send fake security alerts, leading to user credential theft.
NGRAVE
2026-10-19
Funds converted and moved
Stolen funds totaling $2.65 million were converted into Monero and other cryptocurrencies through various exchanges.
bitquery.io

More articles in this cluster (2)

Following this threat?

Track Ngrave in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (19)

1 / 3

Common questions

What should NGRAVE users do now?
Users should immediately change their recovery phrases and monitor their wallets for unauthorized transactions.
How did the attackers gain access?
The attackers exploited a third-party service that sends push notifications to hijack alerts and trick users into revealing their recovery phrases.
Is there a risk of further attacks?
Yes, users should remain vigilant as similar tactics may be employed against other wallet services.