Scammers drain $400K via fake Uniswap Google ads

A phishing site mimicking Uniswap’s interface siphoned roughly $400,000 from victims after they connected their wallets through a Google‑sponsored ad [3]. On‑chain investigator b‑block identified two addresses holding the stolen funds and warned users to verify URLs before approving any transaction [1].

Key takeaways

• Scammers bought Google search ads for “Uniswap” and served a cloned interface that looks identical to the official site [3].
• One trader lost their entire portfolio, estimated at $400,000, after approving a single transaction on the fake site [3].
• The two wallets linked to the theft are 0x37925684BA178821b4436E06e67f5dBD6cfA49Bb and 0x2fC25F46cC49D226eF92E9A7665f3d2821F3c5E2 [1].
• Security experts advise revoking unused token approvals, double‑checking URLs, and avoiding sponsored search results when interacting with DeFi protocols [1].

How the fake Uniswap ad operated

The scam began with a paid Google ad that appeared at the top of search results for “Uniswap.” Clicking the ad directed users to a domain that replicated Uniswap’s front‑end down to the pixel. The cloned site prompted visitors to connect their crypto wallet, a step that appears routine on legitimate decentralized exchanges. Once the wallet was linked, the attacker presented a transaction that seemed harmless but actually granted permission to move the user’s tokens. After the victim approved the transaction, the funds were transferred to the two flagged addresses [1].

Community response and broader context

The incident was first highlighted by on‑chain analyst b‑block on X, who flagged the two addresses and urged traders to only access protocols via official links [1]. The same analyst noted that phishing attacks on DeFi platforms have been rising for months, with scammers routinely buying search ads and registering look‑alike domains. In February, Uniswap founder Hayden Adams publicly condemned such scams, describing them as a persistent problem that continues despite reporting efforts [1].

Why it matters

The $400K loss underscores the vulnerability of DeFi users to social‑engineering attacks that exploit trusted channels like Google search. As phishing and spoofing complaints continue to climb—7,164 reports and more than $111 million in losses in the latest FBI Internet Crime Report—users must adopt stricter security hygiene, including revoking unnecessary token approvals and scrutinizing URLs before signing any transaction [1]. The incident also highlights the need for search platforms to monitor and remove malicious ads that target crypto users.