NGRAVE disclosed LIQUID investigation into the push service provider access compromise incident
BIBIBI
AT A GLANCE
NGRAVE stated that LIQUID the push service provider's permissions were compromised and phishing links were sent, but ZERO wallets and LIQUID code were not compromised.
Article
NGRAVE released LIQUID False Security Alert Incident Report: Push Service Provider Access Compromised
PANews October 21 reported that hardware wallet manufacturer NGRAVE released October 17 LIQUID an investigation report into the false security alert incident involving its app. Attackers compromised the access permissions of a third-party service provider that sends push notifications for LIQUID and sent phishing links to users via push notifications.NGRAVE stated that the first notification service key was exposed through an error message from a server that sends notifications.October 11 After discovering the anomaly,NGRAVE disabled the key within minutes, but the attackers had already used it to obtain a second key.NGRAVE stated that ZERO hardware wallets were not compromised,LIQUID and its code was not leaked; users who did not enter their mnemonic phrase or Perfect Key on the phishing website face no risk to their funds.NGRAVE is tracking the stolen funds and will restrict LI...
Key points
01
NGRAVE released October 17 LIQUID an investigation report into the false security alert incident involving its app.
02
Attackers compromised the access permissions of a third-party service provider that sends push notifications for LIQUID and sent phishing links to users via push notifications.
03
NGRAVE stated that the first notification service key was exposed through an error message from a server that sends notifications.
04
NGRAVE stated that it October 11 disabled the first key within minutes of discovering the anomaly, but the attackers had already used it to obtain a second key.
05
NGRAVE stated that ZERO hardware wallets were not compromised,LIQUID and its code was not leaked.
06
NGRAVE stated that users who did not enter their mnemonic phrase or Perfect Key on the phishing website face no risk to their funds.
07
NGRAVE is tracking the stolen funds.
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
This incident involved LIQUID's push notification channel: attackers obtained access permissions from a third-party push service provider and used the normal notification channel to send phishing links.NGRAVE stated that the issue was not with ZERO the hardware wallet or LIQUID the code itself. Whether users face a risk to their funds depends on whether they entered their mnemonic phrase or Perfect Key。
Why it matters to readers
Even if the hardware wallet and app code have not been compromised, a hijacked notification channel can make malicious links appear to be official messages, inducing users to surrender critical credentials.
When receiving a security alert from a wallet app, do not click links in the notification directly or enter your mnemonic phrase or Perfect Key on a webpage. Users who have entered this information may need to monitor NGRAVE for subsequent disclosures.
Risks and unknowns
The original text is a truncated summary,NGRAVE and the full details of subsequent restrictive measures cannot be confirmed.
The number of affected users and the amount of stolen funds were not specified.
It was not specified whether the second key has been disabled or rotated.
ZERO Claims that it was not breached,LIQUID that its code was not leaked, and that some user funds were risk-free are all NGRAVE statements by, for which this article provides no independent verification.
The results of the tracing of the stolen funds have not yet been disclosed.
Related Developments
Loading event timeline…
Related concepts
mnemonic phrase
This term is not in the glossary yet. Browse related concepts in the glossary.
