Unknown individuals placed malicious advertisements on Google search results, mimicking the interface of the DEX Uniswap. Analysts report that the perpetrators have stolen at least $400,000 in cryptocurrency.
Community alert:
A website impersonating Uniswap is draining funds from multiple wallets.
The scammers are currently holding at least ~$400,000.
0x37925684BA178821b4436E06e67f5dBD6cfA49Bb
0x2fC25F46cC49D226eF92E9A7665f3d2821F3c5E2Please only use official links, and… pic.twitter.com/JikqftTVHY
— b-block (@b_block_oficial) May 25, 2026
An expert known as b-block reported that the fraudulent site redirected users to a clone website, which drained wallets upon connection. At the time of publication, two addresses associated with the scheme held 146 ETH (approximately $306,000).
Researcher Stacy Muur noted that such phishing ads have been promoted to the top of search results for years, often appearing above official cryptocurrency project links.
Two scammers have already stolen ~$400,000 from users through a phishing @Uniswap ad on Google.
It’s insane that Google has ignored this issue for years while fake links keep getting pushed above real ones and users keep getting drained.
This is the first result that popped out… https://t.co/Ov488s9DIl pic.twitter.com/qStRGq8qTE
— Stacy Muur (@stacy_muur) May 25, 2026
DeFiLlama confirmed that fake ads on Google remain one of the most common attack vectors in the decentralized finance sector.
Fake ads on Google are a common source of phishing attacks.
We built LlamaSearch to solve exactly this. It has thousands of vetted crypto domains.
Access at https://t.co/3ohXakDbIZ or https://t.co/2uvCUnNTMy
— DefiLlama.com (@DefiLlama) May 25, 2026
Security Alliance (SEAL) specialists reported a significant surge in such activity. From March 13 to 30, the organization blocked over 356 malicious ad links. The total damage from the campaign amounted to approximately $1.27 million.
According to SEAL, the perpetrators use either direct ad purchases or compromised advertiser accounts for promotion. To bypass Google’s moderation, they display correct URLs while malicious code is loaded through a hidden frame, invisible to the search engine’s automated verification systems.
In April, a fake Ledger Live app in the App Store helped hackers steal cryptocurrency worth at least $9.5 million.