NGRAVE LIQUID phishing alert: what happened and what to do

Short answer: On October 17, 2026, NGRAVE warned that attackers had hijacked the push notification system of its LIQUID wallet app and were using it to send fake security alerts. The fake alerts claim your portfolio synced on a Google Pixel 9 in Moscow, and the ones we reviewed led to ngrave.support. That is not NGRAVE's website. NGRAVE's site is ngrave.io and its help center is support.ngrave.io. Don't tap the alert, and never type your recovery phrase (seed phrase) or Perfect Key into any website.

Key facts

• What: Fake "Security alert" push notifications sent through the real LIQUID app, plus a "Security notice" banner inside the app.
• The story it tells: Your portfolio synced on a new device, a Pixel 9 in Moscow, and you need to review it now.
• Where it sends you: ngrave.support, a lookalike address. NGRAVE uses ngrave.io and support.ngrave.io.
• What it wants: Your seed phrase (24 words) or your NGRAVE Perfect Key.
• NGRAVE's advice: Don't tap any LIQUID notification or any link in the LIQUID app or on social media, and turn off LIQUID notifications in your phone settings until NGRAVE sends an all-clear.
• The ZERO hardware wallet: NGRAVE says private keys never leave the ZERO. The danger is typing your seed phrase into the fake site.
• Still unknown: How attackers got into the notification system and how many people received the alert.

What happened on October 17

NGRAVE emailed customers on October 17, 2026 under the subject "URGENT: Fake LIQUID notifications. Don't click." The email says the push notification system of its LIQUID app has been hijacked and that attackers are using it to send fake security alerts to LIQUID users. The alerts looked like they came from LIQUID because they did come through LIQUID's own notification channel, with the app's name and icon. LIQUID added push notifications in a May 2026 update, according to its App Store release notes.

The screenshots we reviewed show the alert reached people in two ways:

1. Push notifications on the lock screen, titled "Security alert." At least two arrived about half an hour apart, each naming a different time for the same "sync."
2. A banner on the LIQUID home screen, titled "Security notice," just under the Send and Receive buttons. It named ngrave.support as the "security center."

Turning off push notifications stops the alerts on your lock screen, but it does not remove a banner inside the app. NGRAVE's email doesn't mention the banner, but it does tell customers not to click any links in the LIQUID app until it confirms the issue is resolved.

The fake ngrave.support page

The fake site is a page called "Security Center" at ngrave.support. It shows a red "High risk" label, says "1 sync is waiting for your review" from a Google Pixel 9 in Moscow, and runs a 30-minute countdown beside a yellow "Review sync" button. Below that, it lists the visitor's own phone as "Trusted," with its operating system, city and a device ID.

NGRAVE's email says the alert leads to a phishing website built to steal your seed phrase. The email doesn't name the site. The address and page details here come from the screenshots we reviewed. Our screenshots stop at this screen, and you shouldn't go any further either.

Signs the alert was fake

1. The web address is wrong. The last part of a web address decides who owns it. support.ngrave.io ends in ngrave.io, so it belongs to NGRAVE. ngrave.support ends in .support, an ending anyone can register.
2. LIQUID doesn't sync that way. NGRAVE says ZERO and LIQUID talk only through QR codes you scan, and that LIQUID only receives public information such as your addresses. Adding your wallet to a phone means scanning codes from your ZERO, and NGRAVE describes no web page where you approve or block a sync.
3. The times don't match. The two push alerts said 21:30 and 21:53 "today," while the fake page said 01:02 Moscow time. That is three different times for what the page calls a single sync.
4. There's a countdown. A 30-minute clock is there to rush you. A genuine security notice has no reason to put a timer on your decision.
5. Showing your phone and city proves nothing. Any website can see your browser type and roughly where your internet connection is. The fake page shows that back to you with a green "verified" badge so it looks official.
6. It asks for your seed phrase. NGRAVE's email is direct about this: "NGRAVE will never ask for your seed phrase or Perfect Key." Not in the app, not by email and not by direct message.

Was my NGRAVE ZERO hacked?

Nothing made public so far shows the ZERO was breached. NGRAVE's email says private keys never leave the ZERO, and NGRAVE's App Store listing says LIQUID only receives public information from it, such as addresses. Based on that design as NGRAVE describes it, a hijacked notification system can show you a false message but has no direct route to keys stored on the ZERO.

Your funds are at risk if you type your secret into the fake site. With your 24 words or your Perfect Key, an attacker can rebuild your wallet on their own device and move your funds, and the hardware can't stop that. NGRAVE's Perfect Key is a 64-character form of the same 24-word secret, so protect both the same way.

A fake alert also doesn't prove the attackers know your addresses or balances. What data, if any, they could see has not been made public.

What to do if you got the alert

Find the line that matches you.

You saw the alert and did nothing. NGRAVE's email says your assets are safe if you didn't open the link and didn't enter your seed phrase. Turn off LIQUID notifications until NGRAVE gives the all-clear, and don't tap links in the app in the meantime.

You opened ngrave.support but typed nothing. Close the page, and don't download, install or approve anything it offers. Typing your seed phrase or Perfect Key is what hands an attacker your wallet. NGRAVE's email doesn't cover this case directly, so if you're unsure what you entered, contact support@ngrave.io.

You typed your seed phrase or Perfect Key. NGRAVE says to assume it is compromised. Move fast, because anyone with your phrase can move funds as soon as they have it.

1. Create a brand-new wallet with a new seed phrase, on a hardware wallet you trust.
2. Send everything from the old wallet to the new wallet's addresses right away.
3. Never use the old phrase or Perfect Key again.
4. Contact NGRAVE support at support@ngrave.io, which NGRAVE says will help. In the United States, also report the theft to the FBI at ic3.gov.

How to turn off LIQUID notifications

• iPhone: Open Settings, then Notifications, then LIQUID (it may show as NGRAVE LIQUID). Turn off Allow Notifications.
• Android: Open Settings, then Apps, then LIQUID, then Notifications. Turn them off.

Menu names vary by phone. LIQUID also has notification choices in its own settings.

Watch for fake "support" too

NGRAVE warns that scammers reply to its posts or send direct messages pretending to be NGRAVE support, and says it will never message you first. It lists three places for real updates, including the all-clear: @ngrave_official on X, the #announcements channel on NGRAVE's official Discord, and email from support@ngrave.io.

Lessons for businesses

Most phishing training teaches people to check who sent a message. That advice fails when the sender is real: this alert came from the right app, with the right name and icon, and only the request gave it away.

On an iPhone, a notification that carries an app's name and icon can only come from the app itself or from someone holding that app's push credentials, either the app maker or a service that sends notifications for it. An alert like this one means someone got control of a real sending channel. The same can happen with tools your team trusts every day, such as a chat app, a help-desk system, an e-signature service or a bank's app.

So teach one rule: check what the message wants you to do, not just who sent it. If it asks you to enter a secret, approve a sign-in, install something or move money, confirm it another way first. Check it through a channel you already know and didn't get from the message, such as a phone number from your own records or the company's website typed in by hand. In this incident the app itself was the compromised channel.

NGRAVE's warning email is a useful model for the other side of an incident. It quoted the fake alert word for word, told customers which channel to stop trusting, named the only three places it would post updates, and stated that it contained no links apart from its Discord invite and the unsubscribe link.

If your company sends notifications to customers, that channel needs its own guardrails:

• Protect the keys and accounts that can send push messages. Require multi-factor sign-in and give sending rights to as few people as possible.
• Require a second person to approve any message labeled as a security alert.
• Watch for unusual sends, such as a security message going to many users at once.
• Never put links in security alerts. Tell people where to check instead, such as your main website or official accounts.
• Pick your official update channels now, and write the warning you would send if the notification channel itself were abused.

At Obsidian Ridge, we build security awareness training and threat detection around how attacks reach people today, including through apps and services they already use.

Indicators for security teams

Status of this incident

This article is based on NGRAVE's email to customers on October 17, 2026, and on screenshots of the alerts captured the same day, with personal details removed. In its October 17 email, NGRAVE said it was working to resolve the issue. How the attackers reached LIQUID's notification system, and how many people received the alert, has not been made public. NGRAVE will post updates and the all-clear on @ngrave_official on X, its official Discord and by email from support@ngrave.io. We will update this page when NGRAVE shares more.

Talk with us about protecting your business from phishing through trusted apps and services.

Sources

• NGRAVE email to customers, "URGENT: Fake LIQUID notifications. Don't click.", October 17, 2026.
• NGRAVE LIQUID on the App Store: product description (QR-only communication, public information only) and release notes (push notifications added May 2026).
• NGRAVE Help Center: What is the NGRAVE Perfect Key?
• NGRAVE contact page: official support address.
• FBI Internet Crime Complaint Center