Ripple CTO Emeritus David Schwartz has issued an urgent crypto security warning after discovering a suspicious notification linked to the SecuX wallet app on his Android device. The message attempted to direct users to a fraudulent website designed to steal cryptocurrency wallet recovery phrases.
On October 16, 2026, Schwartz shared the incident on X, alerting SecuX that its Android application appeared to have delivered a scam notification. The warning quickly attracted attention from the cryptocurrency community, with one user advising him not to open the suspicious message.
However, Schwartz revealed that he had already tapped the notification out of curiosity. Surprisingly, the action launched the SecuX wallet app normally, without immediately displaying anything suspicious.
Further investigation uncovered the potential phishing attempt. After reviewing his Android notification history, Schwartz discovered a message claiming that a critical security vulnerability had been detected in the SecuX wallet.
The notification warned that users' funds could be at risk and urged them to verify their wallets immediately through an external link. According to Schwartz, the link directed users to a fraudulent website requesting their 12- or 24-word recovery phrases.
Schwartz strongly cautioned cryptocurrency holders against sharing such information, emphasizing, "NEVER DO THAT!"
Wallet recovery phrases are essential security credentials that provide access to cryptocurrency holdings. Anyone obtaining these phrases could potentially restore the associated wallet and transfer its digital assets without authorization.
The incident coincided with an emergency maintenance announcement from SecuX, a cryptocurrency hardware wallet provider. On October 16, the company disclosed that its wallet application was undergoing a major system upgrade intended to improve security and operational stability.
Although the timing raised concerns, SecuX did not disclose the specific reason for the emergency maintenance. The source of the suspicious notification remains unconfirmed, and there is no independent evidence establishing that the company's application or infrastructure was compromised.
SecuX subsequently announced that its wallet app had resumed normal operations. The company also reinforced its security guidance, warning customers against suspicious links, fraudulent support messages, and requests for wallet recovery phrases.
The incident highlights the growing threat of crypto phishing scams targeting digital asset investors. Cryptocurrency users are encouraged to verify security alerts through official channels and never disclose their recovery phrases, even when messages appear to originate from trusted wallet providers.
