Loading article…
Scammers used sponsored Google search ads to mimic Uniswap, stealing more than $400,000 from an experienced trader and other users in May 2026.
An experienced crypto trader known as @ika_xbt lost a portfolio worth over $400,000 after clicking a sponsored Google ad that looked exactly like the official Uniswap site. The ad led to a cloned interface that harvested the user’s wallet approval and drained the funds in a single transaction [1].
Key takeaways
The scammers purchased Google ad space for the keyword “Uniswap,” ensuring their malicious listing appeared at the top of search results. When users clicked the ad, they were taken to a replica of Uniswap’s web interface that looked identical to the real site. The page prompted users to connect their wallet and approve a transaction; once approved, a malicious contract transferred all accessible assets to the attackers’ addresses [1][4]. The scheme does not exploit any vulnerability in Uniswap’s smart contracts; it simply leverages user trust in Google’s search results and the habit of approving transactions without thorough review [1].
On‑chain investigators identified the two receiving wallets—0x37925684BA178821b4436E06e67f5dBD6cfA49Bb and 0x2fC25F46cC49D226eF92E9A7665f3d2821F3c5E2—holding roughly $400 K combined, as reported by analyst b‑block [2]. The Security Alliance (SEAL) has noted a sharp rise in Google‑search phishing campaigns targeting crypto protocols since March 2026, with similar tactics previously draining millions from wallets linked to MetaMask and Binance [4]. The recurring pattern underscores the low barrier for attackers to fund ad campaigns with compromised credit cards and launch new phishing domains within minutes [4].
Uniswap founder Hayden Adams has repeatedly criticized the lack of decisive action from search platforms, calling the scams “horrible” and highlighting that fraudulent apps continued to appear even after reporting efforts [2]. Google’s advertising policies prohibit phishing, yet the company has not publicly commented on this specific campaign, and its automated review process has struggled to keep pace with the rapid creation of new ads [4]. Security firms continue to advise users to avoid sponsored search results, verify URLs, revoke unused token approvals, and consider hardware wallets that require on‑device confirmation of transaction details [1][4].
Coverage is mostly measured — 32 of 37 reports stay neutral.
Every Monday — the token unlocks, Fed dates & catalysts set to move crypto and markets this week. So you’re never blindsided.
Free · 3-min read · one-click unsubscribe
Uniswap is a signatory to a letter urging the Senate to pass the act, specifically emphasizing the importance of Section 604, which provides regulatory certainty for blockchain developers.
Unlike vAMMs, which use virtual accounting entries for pricing, Uniswap v3 utilizes real capital supplied by liquidity providers to back its liquidity curves.
Developers argue that the act is necessary to shield those who do not custody user funds from being classified as money transmitters or facing federal prosecution for building open-source software.
The incident illustrates a persistent vulnerability in the DeFi ecosystem: while blockchain transactions are immutable, the user‑side of the stack—search engines, browsers, and wallet interfaces—remains susceptible to social engineering. As retail participation in DeFi grows, attackers are increasingly exploiting familiar brand names like Uniswap to harvest funds. Until search platforms improve ad vetting and crypto projects develop more robust brand‑protection mechanisms, users must rely on basic hygiene—bookmarking official sites, double‑checking URLs, and using hardware wallets—to protect their assets. The episode also adds pressure on Google to tighten enforcement of its crypto‑ad policies, a development that could shape the security landscape for decentralized finance moving forward.
AI-assisted synthesis by the TrendWatcher Editorial Desk · sourced from 4 outlets · Jun 2, 2026 · How we report