Scammers Steal Over $400,000 Using Fake Uniswap Google Ads

Fraudsters have successfully stolen more than $400,000 by purchasing sponsored Google Ads to place fraudulent, near-identical copies of the Uniswap website at the top of search results [1]. Users who click these links and connect their wallets to the phishing interfaces risk having their assets drained in a single, irreversible transaction [1].

Key takeaways

• Scammers bypassed Google’s moderation by using valid URLs in ad previews while loading malicious code through hidden secondary iframes [1].
• On-chain analyst b-block identified two active attacker addresses holding approximately $407,000 in combined assets [2, 4].
• The Security Alliance (SEAL) reported a surge in similar phishing attacks between March 13 and March 30, 2026, resulting in $1.27 million in total losses [1, 3].
• Experts recommend bookmarking official project URLs and using verification tools like DeFiLlama to avoid interacting with sponsored search results [1, 4].

Tactics behind the phishing campaign

The phishing operation relies on the high visibility of Google’s sponsored search slots to deceive users searching for the legitimate Uniswap platform [1]. These fraudulent sites are designed to perfectly mimic the interface of the real exchange, often using deceptive URLs that appear credible at first glance [1, 2]. Once a user connects their wallet and approves a transaction, a fund-drainer contract automatically withdraws all available tokens [1]. Even hardware wallets provide no protection in this scenario, as the victims are tricked into signing the malicious transaction code themselves [1].

Security researchers have noted that this is part of a broader, long-standing trend where attackers exploit search engine advertising systems [1, 3]. By using techniques such as loading malware through hidden iframes, scammers have managed to evade automated verification tools [1, 3]. The issue has drawn criticism from industry figures, including Uniswap creator Hayden Adams, who has called for an end to the current ad economy model that allows these phishing traps to persist [1].

Why it matters

The persistence of these phishing campaigns highlights a significant security gap in how major search engines vet sponsored content, leaving DeFi users vulnerable to sophisticated impersonation [1, 3]. With attackers frequently moving to new domains following takedowns, analysts emphasize that proactive user verification is currently the most effective defense [1, 3]. As the community continues to grapple with these threats, platforms like DeFiLlama have integrated secure domain search tools to help users distinguish between legitimate sites and malicious clones [1, 2]. Meanwhile, the Uniswap DAO is moving forward with its own governance, including a proposal to expand protocol fee collection to additional chains, even as the platform remains a primary target for these ongoing phishing efforts [1].