NGRAVE Reveals Investigation Into LIQUID App Push Notification Breach

Hardware wallet manufacturer NGRAVE has released a comprehensive incident report regarding a security breach involving its LIQUID mobile application. On October 17, 2026, an attacker successfully hijacked the push notification service used by the app to broadcast phishing links to users. The company has clarified that while the notification system was compromised, the core security of the ZERO hardware wallet remains intact, as the incident was localized to a third-party service provider.

Mechanism of the Notification Hijack

The investigation revealed that the breach originated from a leak of service keys. According to the report, the first notification service key was exposed through error messages generated on a server responsible for handling push alerts. Although NGRAVE security teams detected the anomaly on October 11 and disabled the compromised key within minutes, the attackers had already utilized their brief access to secure a second authentication key. This secondary access point allowed the malicious actors to send unauthorized messages to the LIQUID app's user base on October 17.

Security Status and User Protection

NGRAVE has emphasized that this was a front-end communication breach rather than a compromise of the underlying blockchain technology or private key storage. The company confirmed the following points regarding the safety of user assets:

• The ZERO hardware wallet firmware and hardware components were not compromised.
• The source code for the LIQUID app remains secure and was not leaked during the incident.
• Funds are only at risk for users who manually entered their mnemonic phrases or "Perfect Key" into the external phishing sites.
• No unauthorized access to the NGRAVE internal servers or user databases was identified.

Recovery Efforts and Future Mitigations

In the aftermath of the event, NGRAVE is actively tracking the movement of stolen funds associated with users who fell victim to the phishing attempt. The company is collaborating with cybersecurity experts to enhance the security of its third-party integrations and is implementing stricter protocols for error log management to prevent future key exposures.

Users who did not interact with the phishing links or disclose their recovery seeds remain fully protected, as the hardware wallet's offline nature prevents remote asset theft.

The incident serves as a reminder of the vulnerabilities inherent in centralized communication layers used by decentralized finance (DeFi) tools. NGRAVE has stated it will continue to restrict certain LIQUID app functionalities while a full security audit of the notification infrastructure is completed to ensure the platform meets the highest safety standards.