Crypto Scammers Leverage Google Ads to Swindle $400K from Uniswap Users

crypthub

about 19 hours ago

Attack Method

Threat actors place fake sponsored links above the genuine Uniswap result in Google Ads. They either purchase ad space directly or compromise existing advertiser accounts to run the scams. The phishing URLs look authentic while a hidden element injects malicious code that evades Google’s automated review. Clicking the ad leads to a convincing replica of Uniswap that routes traffic through attacker‑controlled servers.

Impact on Users

The fake site has already drained at least $400,000 from crypto wallets. On‑chain analyst b‑block identified two wallets holding 146 ETH, worth roughly $306,000, as part of the theft. Victims report loss of funds after being redirected from the Google ad to the fraudulent platform.

Scale and Response

Security Alliance (SEAL) recorded a surge in March, with $1.27 million stolen between March 13‑30 and more than 356 malicious ad links blocked weekly for over a year. Stacy Muur of Green Dots highlighted a screenshot of the scam and blamed Google for allowing the problem to persist. DeFiLlama echoed these concerns, calling fake Google ads a common phishing vector in the crypto community.

Wider Campaign

The tactic extends beyond Google, with attackers using AI chat links to spread Mac‑targeted malware and Facebook ads impersonating Microsoft to distribute credential‑stealing Windows 11 installers. SEAL continues to receive victim reports and says the campaign shows no sign of stopping.