# NGRAVE Finds Attackers Copied LIQUID Notification List in Phishing Attack By Simon Yoon Canonical URL: https://www.tokenpost.com/news/technology/36554 Published: 2026-10-21T10:32:08.000Z Updated: 2026-10-21T10:32:08.000Z Section: Technology > The copied data included device and usage details. Other customer records were accessible, but NGRAVE is still checking whether they were taken. NGRAVE found that attackers copied data from a LIQUID notification list during the Oct. 17 phishing attack, widening the known exposure beyond the fake alerts that led users to surrender wallet recovery credentials. The list used to deliver app notifications contained notification tokens, phone models, operating systems, LIQUID versions, languages, countries, time zones, usage data and an internal app ID. Some entries may also have included IP addresses and approximate locations. The notification list is the data confirmed to have been copied. A second access key could reach swap history and other app usage records, but NGRAVE is still checking whether attackers took those records. They could also read a separate set of data-deletion requests containing email addresses and order numbers for a small number of customers. NGRAVE has not established that the requests were copied. The attackers hijacked access used by LIQUID’s outside notification provider and obtained a key with broader permissions. Malicious alerts arrived around 5:30 p.m. ET (21:30 UTC) on Oct. 17. They directed users to a counterfeit NGRAVE site that asked for a recovery phrase or Perfect Key. Users who entered those credentials had funds stolen. Neither LIQUID’s code nor NGRAVE’s ZERO hardware wallet was breached. Either credential lets someone restore the wallet and transfer its holdings without possessing the ZERO device. NGRAVE has [traced about $2.56 million in losses tied to roughly 70 wallet addresses]() on four networks. The $2.56 million total is valued at Oct. 17 prices and remains a minimum pending checks of other networks and customer reports. NGRAVE has revoked the compromised access and replaced keys used by its live systems. It plans to allow links in LIQUID notifications and in-app messages to open only official NGRAVE sources, addressing the route that led users to the counterfeit site. It also plans a key limited to sending notifications and a requirement that two people approve every notification and in-app message. The company is reporting the data exposure to the Belgian Data Protection Authority while it continues to assess whether attackers copied the additional records. ## Links in this article - [traced about $2.56 million in losses tied to roughly 70 wallet addresses](https://www.tokenpost.com/news/technology/36542)