Fake Uniswap Google Ads Steal $400K in Phishing Scam

A sophisticated phishing campaign utilizing sponsored Google advertisements has stolen over $400,000 from cryptocurrency users by impersonating the decentralized exchange Uniswap. An experienced trader known as @ika_xbt reportedly lost their entire portfolio after clicking a fraudulent link that appeared above legitimate search results [1]. On-chain investigators have identified two attacker wallets holding approximately 146 ETH, valued at around $306,000 at the time of discovery, with total losses exceeding $400,000 [1][4].

Key takeaways

• Scammers used sponsored Google ads to clone Uniswap’s interface, stealing over $400,000 from victims [1][4].
• The attack relies on malicious contracts that drain assets once a wallet connects and approves a transaction [1].
• Security groups report a sustained increase in such campaigns, with Uniswap being the most targeted brand [4].

Mechanics of the deception

The attack surfaced around May 25 and 26, 2026, when analysts like b-block and Stacy Muur issued warnings about the active exploit [1][4]. Threat actors purchase sponsored ads targeting keywords like "Uniswap," ensuring their fraudulent links appear above the official organic listings [1]. These sites often use Punycode URLs containing Cyrillic characters to look visually identical to the real domain, while hidden iframes load malicious payloads that evade Google’s automated detection [4].

Once a user lands on the cloned page and connects their wallet, they are prompted to sign a transaction approval. This specific attack utilized a "scam-as-a-service" script known as AngelFerno, which grants attackers permission to drain assets directly from the victim’s wallet [4]. Because blockchain transactions are irreversible, victims have no recourse for recovery once the approval is signed [1].

Rising threat of search engine phishing

This incident is part of a broader trend identified by the Security Alliance (SEAL), which noted a "significant uptick" in phishing activity on Google Search since March 2026 [3]. The organization reported that similar campaigns stole approximately $1.27 million between March 13 and March 30 alone, having blocked over 356 malicious advertisement links over the past year [3][4]. Uniswap was the most impersonated brand in these attacks, accounting for 41% of detected malicious sites [4].

Uniswap founder Hayden Adams has publicly condemned search platforms for failing to act decisively against these scams, noting that fraudulent ads continue to reappear despite reporting efforts [1][2]. The FBI’s 2025 Internet Crime Report highlights the scale of the issue, documenting over $11 billion in crypto-related losses, with phishing and spoofing accounting for more than $111 million [2].

Why it matters

The irreversible nature of blockchain transactions makes user vigilance the primary defense against such sophisticated social engineering attacks [1]. Security experts recommend bookmarking legitimate URLs and avoiding sponsored search results when accessing protocols [1][2]. While hardware wallets can offer an additional layer of security by requiring on-device confirmation, they are not foolproof if users do not meticulously review transaction details [1].