NGRAVE Releases Report on LIQUID False Security Alert Incident: Push Service Provider Access Was Hijacked

PANews reported on October 21 that hardware wallet maker NGRAVE released an investigation report on the October 17 false security alert incident involving the LIQUID app. The attacker hijacked access to a third-party service provider that sends push notifications for LIQUID and pushed phishing links to users. NGRAVE said the first notification service key was leaked through an error message from a server that sends notifications. After discovering the anomaly on October 11, NGRAVE disabled the key within minutes, but the attacker had already used it to obtain a second key. NGRAVE said the ZERO hardware wallet was not compromised and the LIQUID code was not leaked; users who did not enter their seed phrase or Perfect Key on the phishing website are not at risk of losing funds. NGRAVE is tracking the stolen funds and will restrict LIQUID to only open links from NGRAVE's own sources, while adding alerts for abnormal key usage and a short-lived key mechanism.