$400K Stolen via Fake Uniswap Google Ads

Scammers have siphoned at least $400,000 from cryptocurrency users by deploying fake Uniswap advertisements on Google, according to on-chain warnings [1]. The malicious scheme utilized sponsored search results to redirect victims to phishing sites that mimicked the legitimate decentralized exchange, allowing attackers to drain assets from connected wallets [1].

Key takeaways

• At least $400,000 was stolen after users clicked sponsored Google search results impersonating Uniswap [1].
• On-chain analyst b-block and marketing expert Stacy Muur traced the funds to phishing interfaces that captured wallet approvals [1][3].
• The Security Alliance (SEAL) reported a "significant uptick" in Google Search phishing campaigns targeting crypto protocols since March [3].
• Attackers bypassed Google’s filters using legitimate-looking URLs and hidden iframes to load malicious payloads [3].

How the Uniswap Phishing Trap Operated

The scheme was identified by analyst b-block and traced by Stacy Muur, founder of Web3 marketing agency Green Dots, who found that users clicked sponsored Google results when searching for "Uniswap" [1][3]. These advertisements led to counterfeit interfaces designed to capture wallet approvals or seed phrases, which the attackers then used to drain assets [1]. To evade detection, the phishing ads employed legitimate-looking URLs to bypass automated checks while a hidden secondary iframe loaded the malicious payload [3]. At the time of reporting, two flagged addresses held a combined 146 ETH worth approximately $306,000, though total losses were tracked higher [3].

A Surge in Search-Based Crypto Attacks

This incident is part of a broader escalation in crypto-targeted search ad abuse [1]. The Security Alliance (SEAL) noted that attackers either pay for ads or hijack legitimate advertiser accounts to outbid real protocols for superior placement in sponsored results [3]. The organization reported blocking over 356 malicious advertisement links in a single week, a volume described as representative of a steady stream of attacker-deployed Google Ads for more than a year [3]. Google’s advertising policies ban phishing and deceptive content, but the company has not publicly commented on this specific Uniswap campaign [1].

Why it matters

The attack highlights a persistent security gap for retail investors entering decentralized finance (DeFi), as many users assume sponsored search results are vetted by the platform [1]. Security experts recommend that users verify website URLs, bookmark official domains, and consider