A major phishing attack has struck users of the LIQUID app, leading to the theft of over $256 million in cryptocurrency. The study highlights an alarming trend: the increasing sophistication of phishing schemes targeting cryptocurrency users. NGRAVE, the security firm investigating the incident, has provided alarming details about how the attack unfolded and the measures taken to mitigate the damage.
Attackers Exploit Vulnerability in Third-Party Notification Provider
On October 17, attackers exploited a vulnerability in a third-party notification provider associated with LIQUID. They sent out deceptive alerts that misled users into visiting a fraudulent recovery page. Victims who entered their recovery phrases or Private Keys inadvertently gave attackers access to their funds.
NGRAVE's Incident Report
NGRAVE's incident report, released on October 19, disclosed that approximately $256 million was stolen from around 70 wallet addresses across four different networks. The breakdown of the stolen assets includes:
- nearly $177 million in Bitcoin
- $454,000 in XRP
- $316,000 in Ethereum
- $18,000 in Stellar
Clarification on Security Breach
Importantly, NGRAVE clarified that this incident does not reflect a breach of the cryptographic security of their ZERO hardware devices. In response to the attack, the company has disabled the compromised notification channel and replaced the affected keys. They urge wallet holders to remain vigilant, reminding them that legitimate security alerts will never ask for recovery phrases to be entered on a website.
In a recent development, NextBlock completed a $3 million investment in Soda Labs, emphasizing the importance of privacy in blockchain technology. This move contrasts sharply with the recent phishing attack on the LIQUID app, which resulted in significant cryptocurrency losses. For more details, read more.
