Ripple's David Schwartz warns of SecuX-branded Android alert seeking recovery phrases
In brief
- Ripple's David Schwartz said an Android notification appearing to come from SecuX linked to a scam page.
- The scam page asked for 12- or 24-word phrases, likely a wallet recovery phrase.
- The notification's origin is unknown, and no compromise of SecuX has been established.
- SecuX said it will never ask for a recovery phrase and its app has resumed normal operations.
What Schwartz saw
Schwartz went straight to the company in public. He told SecuX that its Android app appeared to have sent him a scam notification, U.Today reported, and an X user quickly told him not to tap it.
He already had.
Schwartz said he tapped it to see what would happen and the app opened normally. The real message only showed up in his notification history, where he found a link to a page asking for a 12- or 24-word phrase.
"I tapped on it to see what would happen and it launched the app normally. I had to go to my notification history to see the message. The link goes to a scam page that asks you to input your 12/24 words. (NEVER DO THAT!)"
The notification told users their funds might be at risk because of a critical vulnerability in SecuX wallet, and it said they had to verify their wallet immediately. Schwartz said the link that came with it was fraudulent.
Why the phrase matters
U.Today said those 12- or 24-word phrases might refer to the wallet recovery phrase. Anyone who gets hold of it can restore the wallet and take control of the funds. Schwartz's advice was short: never enter it.
Where the notification came from still isn't known. It could have been the app itself, a third-party notification service or some other source, and nothing reported so far shows that SecuX's systems were breached.
What SecuX has said
SecuX, a cold wallet provider, said on October 16 that its wallet app was undergoing a major system upgrade and emergency maintenance to improve security and stability. It didn't disclose what the emergency issue was.
The company urged users not to click suspicious or unverified links and never to share their 24-word recovery phrase with anyone. Users were also advised to watch for messages impersonating SecuX Support (a common follow-up tactic in phishing campaigns, where the "support agent" asks for the same words).
In a separate service update, SecuX said the app had resumed normal operations. It repeated that users shouldn't share their recovery phrase, and that it'll never ask for one.
Frequently asked questions
What did the suspicious SecuX notification say?
The notification said users' funds might be at risk because of a critical vulnerability in SecuX wallet and told them to verify their wallet immediately. David Schwartz said the link that came with it was fraudulent and led to a page asking for 12- or 24-word phrases.
Was SecuX's app hacked?
That hasn't been established. Nobody knows whether the notification came from the app itself, a third-party notification service or another source, and the available information doesn't independently show that SecuX's app or infrastructure was compromised.
Why is a 12- or 24-word phrase so sensitive?
According to U.Today, these phrases likely refer to a wallet recovery phrase. Anyone who obtains it can restore the wallet and take control of its funds, which is why Schwartz warned users never to enter it and SecuX said it will never ask for one.
