Search

Uniswap

Stacy

DeFi

Gnosis

Fake Google ads impersonating Uniswap have stolen at least <a href="https://x.com/b_block_oficial/status/2058874189164040664" rel="noopener noreferrer nofollow">$400,000 from crypto users</a>, adding another major loss to a phishing wave targeting DeFi wallets through sponsored search results.
The campaign used paid Google search ads that led users to fake Uniswap websites instead of the real decentralized exchange interface. Users who connected wallets or signed malicious prompts on those phishing pages had funds drained by attacker-controlled contracts.
Two scammer wallets were linked to the latest campaign, with one holding about 146 ETH worth more than $300,000 and another holding additional stolen assets. The total tracked haul was placed above $400,000 as the fake ads continued circulating.
<a href="https://x.com/stacy_muur/status/2058889644935442468" rel="noopener noreferrer nofollow">Stacy Muur</a>, founder of Web3 marketing agency Green Dots, also flagged the campaign after sponsored search results for fake Uniswap pages appeared above legitimate links. The tactic is especially dangerous because many users still reach DeFi apps by searching a protocol name and clicking the first result.
The latest drain follows a broader run of crypto security incidents, including the recent <a href="https://cryptoadventure.com/squidroutermodule-exploit-drains-86-gnosis-safes-for-about-3m/" rel="noopener noreferrer nofollow">SquidRouterModule exploit that drained 86 Gnosis Safes</a> across Ethereum and Base.
<h2 id="google-search-phishing-campaigns-accelerate">Google Search Phishing Campaigns Accelerate</h2>
Crypto phishing through Google Search ads has intensified since March. <a href="https://www.linkedin.com/posts/seal-org_malicious-google-ads-targeting-crypto-activity-7452364029798391808-Ld5Y" rel="noopener noreferrer nofollow">Security Alliance</a> tracked malicious Google Ads campaigns targeting DeFi apps, wallets and crypto services, with more than 356 phishing URLs blocked in recent weeks.
The campaigns often rely on two routes. Attackers either buy ads for fake protocol websites directly or compromise legitimate advertising accounts and use them to push malicious links. That gives the fake pages stronger placement and makes them harder for users to distinguish from ordinary sponsored results.
Uniswap is a repeated target because it is one of the most used DeFi interfaces. A <a href="https://cryptoadventure.com/wallet-drainer-landing-pages-the-visual-patterns-that-give-them-away/" rel="noopener noreferrer nofollow">fake swap page</a> can request token approvals, malicious signatures or direct wallet actions that look normal to less experienced users. Once a wallet signs the wrong prompt, attackers can move approved tokens quickly and route stolen funds through other wallets or exchanges.
The same pattern has been visible across wider DeFi losses this year. Recent tracking showed <a href="https://cryptoadventure.com/defi-exploit-losses-hit-816-9m-as-2026-crypto-hack-total-reaches-1-1b/" rel="noopener noreferrer nofollow">DeFi exploit losses reaching $816.9 million</a> as wallet drains, protocol exploits and phishing-linked incidents continued to hit users and platforms.
<h2 id="wallet-users-face-search-ad-risk">Wallet Users Face Search-Ad Risk</h2>
The latest Uniswap phishing campaign shows why search ads remain a serious risk for self-custody users. The fake sites do not need to hack Uniswap itself. They only need to intercept users before they reach the correct interface.
The safest path is direct navigation through saved bookmarks, verified protocol domains and wallet warnings before any approval or signature is confirmed. Users who clicked a fake Uniswap ad should review recent signatures, check token approvals and move remaining assets to a clean wallet if a malicious transaction was signed.
The incident also adds pressure on advertising platforms to remove scam placements faster. <a href="https://cryptoadventure.com/staying-safe-from-crypto-phishing-attacks-in-2026/" rel="noopener noreferrer nofollow">Crypto phishing</a> has become more polished, better funded and more persistent, while attackers continue targeting the same high-traffic DeFi brands users search for every day.
The next signals are the movement of the two tracked scam wallets, additional victim reports, takedowns of the fake domains and whether the stolen ETH moves toward exchanges, mixers or new phishing infrastructure. The confirmed damage already sits above $400,000, and the campaign remains part of a wider Google Ads phishing wave aimed at crypto wallets.
The post <a href="https://cryptoadventure.com/fake-uniswap-google-ads-steal-at-least-400k-from-crypto-users/" rel="noopener noreferrer nofollow">Fake Uniswap Google Ads Steal At Least $400K From Crypto Users</a> appeared first on <a href="https://cryptoadventure.com" rel="noopener noreferrer nofollow">Crypto Adventure</a>.

Fake Uniswap Google Ads Steal At Least $400K From Crypto Users

Table of Contents

Crypto Adventure

Other articles published on May 26, 2026

Join our free newsletter for daily crypto updates!