NGRAVE's wallet app phished its own users. Through the official push channel.
Oct 17, 5:30 PM ET: LIQUID, the companion app to the ZERO hardware wallet, pushed a "Security alert" about a new sync from a Pixel 9 in Moscow. Attackers had hijacked its third-party notification provider. The "Deny" button led to a page asking for your 24 words. First wallet emptied six minutes later.
NGRAVE's incident report traces ~$2.56M from ~70 addresses so far. Bitquery counts $2.65M, mostly parked on Hyperliquid as XMR1, a Monero token. The attacker could also read LIQUID swap history, so mind the follow-up DMs. CEO: "we have absolutely and utterly failed." Planned fix: two people approve every notification.
The keys never left the cold wallet. The app just asked people to bring them outside.
Source: https://www.ngrave.io/en/blog/incident-report-fake-liquid-security-alert-17-october