NGRAVE says attackers compromised a third-party service behind LIQUID app notifications. Fake alerts led users to a site seeking recovery phrases.
@Bitquery_io traced $2.16M in suspected phishing proceeds to 39 Hyperliquid accounts.
via @hardeyjumoh
cryptoslate.com/crypto-wallet-…
@Bitquery_io traced $2.16M in suspected phishing proceeds to 39 Hyperliquid accounts.
via @hardeyjumoh
cryptoslate.com/crypto-wallet-…
Oct 20, 2026 · 2:06 PM UTC
3
1
2
1,326
@CryptoSlate Second companion app hit in two days through rogue push alerts (SecuX on Oct 16).
App alerts are delivered by cloud services, not by your hardware wallet. The rule never changes: no real security alert ever needs your recovery phrase.
App alerts are delivered by cloud services, not by your hardware wallet. The rule never changes: no real security alert ever needs your recovery phrase.
0
0
0
23
@CryptoSlate @Bitquery_io @hardeyjumoh hijacking the app's own notification service is the nasty version, the alert looks real because it came through the real channel.
no legit wallet asks for a recovery phrase, not by push, email or dm.
2.16m across 39 hyperliquid accounts says the exits were ready.
no legit wallet asks for a recovery phrase, not by push, email or dm.
2.16m across 39 hyperliquid accounts says the exits were ready.
0
0
0
21