David Schwartz, Ripple’s CTO Emeritus, has publicly warned of a phishing attempt that appeared as a push notification from the SecuX hardware wallet app on Android devices. The alert directed users toward a fraudulent page requesting sensitive recovery phrases that could grant full control over cryptocurrency holdings.

Suspicious Notification and Phishing Link

Schwartz described receiving a notification on his Android phone that seemed to originate from the SecuX wallet application. The message claimed a critical vulnerability had been detected and stated that funds might be at risk, urging immediate verification of the wallet.

When he tapped the alert, the legitimate SecuX app opened without apparent issues. Later examination of the device’s notification history revealed the message contained a link leading to an external site. That page asked visitors to enter their 12- or 24-word recovery phrase, the standard seed phrase used to restore access to a wallet on compatible software or hardware.

Schwartz stressed that users should never provide these phrases. A recovery phrase allows complete restoration of a wallet and control of its assets, making it a primary target for scammers.

SecuX Response and Ongoing Access Problems

SecuX, a provider of hardware cold wallets designed to store digital assets offline, announced on October 16 that its Android app was undergoing a major system upgrade and emergency maintenance aimed at improving security and stability. Later the same day the company stated that normal operations had resumed.

Despite the announcement, multiple users continued to report difficulties accessing their wallets on October 17. SecuX did not publicly detail the cause of the disruption. The company repeated that its application never requests recovery phrases and cautioned users against clicking unverified links or responding to messages that impersonate SecuX support.

In official guidance, SecuX stated that the app does not ask for the 24-word recovery phrase under any circumstances and advised users to remain vigilant against phishing attempts.

Unclear Origin of the Alert

Schwartz did not establish whether the notification was generated by the SecuX application itself, a third-party notification service, or another source. Available information does not confirm a direct compromise of SecuX’s systems or infrastructure. Access complaints centered on the app service, while the reported phishing alert specifically involved the Android version.

Hardware wallet providers routinely advise users to keep recovery phrases offline and private. Similar phishing campaigns in the past have used fake websites that mimic legitimate wallet services to solicit seed phrases. SecuX has reinforced that any request for these words should be treated as fraudulent.

Users of SecuX and other hardware wallets are advised to verify notifications carefully, avoid entering recovery phrases on any website or application, and monitor official company channels for updates regarding service status.