Hardware wallet maker NGRAVE published an investigation report on the October 17 fake security alert incident affecting its LIQUID companion app. Attackers compromised access credentials of a third-party push notification service provider used by LIQUID, exploiting them to deliver phishing links directly to users' devices. The breach originated from an error message on a notification server that leaked the first push service key. After detecting anomalies on October 11, NGRAVE disabled the exposed key within minutes, but attackers had already used it to obtain a second key. NGRAVE confirmed that no ZERO hardware wallets were compromised and LIQUID source code was not leaked, stating that users who did not enter their mnemonic phrases or Perfect Key on the phishing sites face no risk to their funds. In response, NGRAVE is tracking stolen assets and implementing stricter controls: LIQUID will now only open links originating from NGRAVE's own domains, with added anomalous key usage alerts and short-lived key mechanisms to prevent future exploitation.