Fake Uniswap Site Drains $400,000 From Wallets

A phishing website impersonating the decentralized exchange Uniswap has drained approximately $400,000 from multiple cryptocurrency wallets. On-chain investigator b-block issued a community alert regarding the attack, noting that the stolen funds are currently held across two flagged addresses [1]. Security experts attribute the theft to malicious actors using fraudulent interfaces to trick users into signing malicious approvals [1].

Key takeaways:

• A fake Uniswap interface has drained roughly $400,000 from victims [1].
• On-chain analyst b-block identified two addresses holding the stolen assets [1].
• Attackers reportedly used fake Google ads to direct users to malicious sites [2].
• The FBI reported $11.36 billion in crypto-related losses for 2025 [1].

Malicious Ads and Stolen Funds

According to Etherscan data cited by Binance, two specific flagged addresses hold approximately 146 ETH, valued at around $306,000 [2]. Stacy Muur, founder of Web3 marketing agency Green Dots, criticized Google for allowing fake sponsored search results to appear above legitimate links, which reportedly led to the continuous theft of user funds [2]. KuCoin reports indicate that attackers utilized cloned websites and hidden scripts to bypass Google’s security systems, often hijacking legitimate business ad accounts to deploy deceptive links [3]. Attackers reportedly used paid Google advertisements to push malicious links above legitimate search results, with some scammers creating advertiser accounts directly while others hijacked existing business accounts [3]. These fake links often used convincing website addresses designed to avoid suspicion [3].

A Widespread Security Threat

This incident is part of a broader trend of increasing phishing activity in the decentralized finance (DeFi) sector. Fake interfaces have become one of the most common phishing vectors in DeFi, as scammers buy search ads and register lookalike domains that mirror the official front-end [1]. The Security Alliance (SEAL), a crypto nonprofit, reported a significant rise in phishing activities on Google searches in March, noting that attackers used hidden iframes to load malicious payloads [2]. Between March 13 and 30 alone, total stolen funds from such attacks reached $1.27 million [2]. Malwarebytes also identified Facebook as a major platform for fake ads and scams, indicating the issue extends beyond search engines [2].

Why it matters

The frequency of these attacks highlights the critical need for users to verify URLs and avoid clicking sponsored search results when interacting with DeFi protocols [1]. The FBI’s 2025 Internet Crime Report logged 181,565 cryptocurrency-related complaints totaling $11.36 billion in losses, marking a 22% increase from the previous year [1]. Crypto-linked phishing and spoofing alone produced 7,164 complaints and more than $111 million in reported losses according to the FBI [1]. Data from blockchain security firm Scam Sniffer also showed that signature phishing attacks siphoned $6.27 million from crypto wallets during the first month of the year [1].