Ripple CTO Emeritus David Schwartz has issued a warning after encountering a suspicious notification on his Android device, which appeared to come from the SecuX wallet app. SecuX is a provider of hardware cold wallets designed to securely store cryptocurrencies offline, aiming to safeguard users against online threats.
Suspicious notification ties to phishing attempt
Schwartz reported receiving a push notification that seemed to originate from the SecuX app. He initially shared his experience on the X social platform, noting that the message claimed a critical vulnerability had been detected, warning that, “Your funds may be at risk, critical vulnerability detected in SecuX wallet, verify your wallet immediately.”
When Schwartz tapped the notification, the app launched normally, causing no immediate alarm. However, after further investigation, he checked his notification history where he discovered the suspicious message. The alert contained a link to a website requesting users to enter their wallet’s 12 or 24-word recovery phrase—a clear indication of a phishing attack designed to steal sensitive wallet information.
Schwartz urged, “Never do that,” stressing the critical importance of not sharing the 12- or 24-word seed phrases that allow full access to a crypto wallet’s funds.
Mini dictionary: SecuX is a company specializing in hardware cold wallets used for storing cryptocurrency assets offline, offering an additional layer of security against online hacking attempts.
Another user responded to Schwartz, advising him not to interact with suspicious notifications. However, Schwartz acknowledged that he had already tapped the alert out of curiosity, and although no unusual activity followed, the presence of a malicious link in the notification history confirmed the fraudulent intent.
Security measures and service update
Around the same time, SecuX informed the crypto community of “emergency maintenance” for its Android app. On October 16, the company explained its wallet application was undergoing a major upgrade and emergency maintenance to improve both security and stability. The announcement did not specify the cause of the emergency, leaving the connection between the maintenance and Schwartz’s experience uncertain.
The origin of the suspicious notification has not been independently confirmed. It remains unclear whether the alert was generated by the SecuX app, a third-party notification service, or another source entirely. Information so far does not confirm a direct compromise of SecuX’s app or its underlying infrastructure.
In an official communication, SecuX reiterated that users should avoid clicking on suspicious or unverified links and should never share their wallet’s 24-word recovery phrase. The company also cautioned against phishing attempts, including messages impersonating SecuX Support.
The provider emphasized that their app does not request the recovery phrase and warned, “Never share your 24-word recovery phrase with anyone.”
After completing system maintenance, SecuX reported that the app had resumed normal operations. The company once again reminded its users that under no circumstances would the app request a recovery phrase and reinforced best practices for wallet security.
