Safety researchers say Google’s advert platform has been weaponized for over a 12 months, with risk actors working faux sponsored hyperlinks that funnel unsuspecting crypto customers to phishing websites designed to empty their wallets.
How The Assault Works
The scheme targets individuals looking for Uniswap, the decentralized trade, by putting fraudulent advertisements above the official web site in Google’s sponsored outcomes part.
Attackers both buy advert house outright or break into present advertiser accounts to run the faux listings, then outbid the true protocol to safe the highest place.
What makes the advertisements exhausting to catch is how they’re constructed. The phishing hyperlinks use URLs that look genuine, whereas a hidden secondary ingredient quietly masses the malicious code — invisible to Google’s automated assessment methods.
Victims who click on by means of land on convincing replicas of the true Uniswap platform, with all their community exercise routed silently by means of attacker-controlled servers.
Group alert:
A web site impersonating Uniswap is draining funds from a number of wallets.
The scammers are presently holding at the very least ~$400,000.
0x37925684BA178821b4436E06e67f5dBD6cfA49Bb
0x2fC25F46cC49D226eF92E9A7665f3d2821F3c5E2Please solely use official hyperlinks, and… pic.twitter.com/JikqftTVHY
— b-block (@b_block_oficial) Might 25, 2026
On-chain analyst “b-block” raised the alarm on Monday after tracing stolen funds to addresses linked to the faux Uniswap web site.
On the time of writing, two flagged wallets held a mixed 146 ETH, valued at roughly $306,000. The whole haul is estimated at at the very least $400,000.
A Yr Of Losses
The nonprofit Safety Alliance, often called SEAL, has been monitoring the broader sample. In response to the group, there was a pointy rise in such a phishing exercise in March, with $1.27 million stolen between March 13 and 30 alone.
SEAL mentioned it blocked greater than 356 malicious advert hyperlinks, describing that quantity as typical of weekly attacker exercise sustained for greater than a 12 months — and mentioned the tempo has not slowed.
Stacy Muur, founding father of Web3 advertising company Inexperienced Dots, shared a screenshot of 1 such sponsored end result and mentioned scammers had used it to steal funds from customers. She known as out Google straight, saying the corporate has let the issue persist for years whereas customers proceed to lose cash.
DeFiLlama, a crypto knowledge platform, echoed the priority, calling faux Google advertisements a standard and recurring supply of phishing assaults concentrating on the crypto neighborhood.
Two scammers have already stolen ~$400,000 from customers by means of a phishing @Uniswap advert on Google.
It’s insane that Google has ignored this concern for years whereas faux hyperlinks hold getting pushed above actual ones and customers hold getting drained.
That is the primary end result that popped out… https://t.co/Ov488s9DIl pic.twitter.com/qStRGq8qTE
— Stacy Muur (@stacy_muur) Might 25, 2026
The Risk Spreads Past Google
The Uniswap case is a part of a wider sample hitting a number of platforms and audiences. Experiences point out that in early Might, attackers had been abusing each Google Advertisements and shared chat hyperlinks from AI instruments to push malware concentrating on Mac customers in an lively marketing campaign.
In the meantime, studies notice that Fb has seen an analogous wave of pretend paid advertisements, with scammers mimicking official Microsoft promotions and directing customers to counterfeit Home windows 11 obtain pages loaded with credential-stealing malware.
SEAL mentioned it continues to obtain studies from victims and that the marketing campaign exhibits no signal of stopping.
Featured picture from Unsplash, chart from TradingView
Editorial Course of for bitcoinist is centered on delivering completely researched, correct, and unbiased content material. We uphold strict sourcing requirements, and every web page undergoes diligent assessment by our group of prime know-how consultants and seasoned editors. This course of ensures the integrity, relevance, and worth of our content material for our readers.
