Case File #84: The Alert Was the Attack

So what happened? Our lead is an October 19th report about an attack that began earlier.

Engrave says compromised third-party notification access sent liquid users to a fake site seeking recovery material.

Its report traces at least $2.56 million from about 70 wallet addresses.

That is a reported minimum, not the final tally.

The company says the zero hardware device and the liquid app code were not breached.

Here's why it matters.

My assessment, the delivery channel helped sell the lie.

We teach people to distrust random messages.

This case asks us to go further and inspect the action even when the message appears in a familiar place.

A logo cannot explain why a security check needs your recovery phrase.

A countdown cannot make that request legitimate.

So before touching another button, put the request into ordinary words.

Somebody wants me to disclose the material that controls my wallet.

Does that help me investigate an alert or does it give another person access? Taking away the design, the logo, and the urgency can make the decision easier to see.

And family, this is not a reason to shame the people affected.

Security language is powerful because it targets the part of us trying to do the responsible thing.

We all need a process that still works when we feel afraid.

So, when this happens, close the alert and reach support through an independently saved official route.

Describe the message without sending your secrets.

If recovery material has been exposed, changing an app password does not replace the underlying keys.

MetaMask's migration guidance calls for a separate wallet with a fresh recovery phrase.

It also warns that an active sweeper can steal gas deposited into the compromised account, so do not keep feeding it funds while attempting recovery.

Engrave distinguishes simply opening this particular link from entering recovery material.

Clicking alone did not give that site the secret.

Typing it did.