NGRAVE’S HIJACKED LIQUID ALERT TOOK $1.77 MILLION IN BITCOIN — THE ZERO’S KEYS HELD — THE ATTACKER COULD READ SWAP HISTORY TYING ADDRESSES TO IP AND LOCATION

On October 17, 2026, at about 21:30 UTC, people using Ngrave's LIQUID app got an alert saying their portfolio had synced on a Pixel 9 in Moscow. It was fake. Attackers had taken the access key of the outside company that sends LIQUID's push notifications. The link led to a copy of Ngrave's site that asked for the 24-word recovery phrase or the Perfect Key. Ngrave's report, published October 19, counts about $2.56 million taken from about 70 addresses on four networks. Bitcoin was the biggest share, $1.77 million.

The ZERO device did its job. Ngrave says the keys never left it and the attacker never reached it. The money left because people typed their seed words into a web page. No hardware can protect a phrase its owner hands over. And this request came through the vendor's own alert channel, the one channel a careful owner had learned to trust.

The theft is the headline. The bigger problem is what the stolen key could read. Ngrave says the attacker copied the notification list, one entry per phone with model, country and time zone. The key could also read swap history with addresses, amounts and times, and app data with IP address and general location. In Ngrave's words, that data “could let the attacker link their wallet addresses and amounts to their IP address and approximate location.” That is a list of who holds how much, and roughly where.

Self-custody means the keys are yours. It does not mean the wallet maker forgets what you hold. Every record a wallet company keeps about your balances is a record someone else can take. Ngrave says it is reporting the exposure to the Belgian Data Protection Authority and reviewing whether it needs to keep swap history at all. At the time of this writing, bitcoin was $83,752.