Uniswap

Stacy

DeFi

Verify

Security

<p>Cybercriminals have exploited Google’s advertising platform once again, stealing more than $400,000 from crypto users through sophisticated phishing advertisements impersonating the popular decentralized exchange Uniswap.The campaign came to light on May 25, 2026, when on-chain investigator <a href="https://x.com/b_block_oficial/status/2058874189164040664" rel="noopener noreferrer nofollow">b_block_oficial identified</a> attacker-controlled wallets receiving funds from drained victim wallets. Blockchain data revealed that two primary attacker wallets linked to the scam held approximately 146 ETH (worth around $306,000 at the time), along with additional tokens.</p>
<blockquote class="twitter-tweet">
 <p>Two scammers have already stolen ~$400,000 from users through a phishing <a href="https://twitter.com/Uniswap?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@Uniswap</a> ad on Google.</p>
 <p>It’s insane that Google has ignored this issue for years while fake links keep getting pushed above real ones and users keep getting drained.</p>
 <p>This is the first result that popped out… <a href="https://t.co/Ov488s9DIl" rel="noopener noreferrer nofollow">https://t.co/Ov488s9DIl</a><a href="https://t.co/qStRGq8qTE" rel="noopener noreferrer nofollow">pic.twitter.com/qStRGq8qTE</a></p>
 <p>— Stacy Muur (@stacy_muur) <a href="https://twitter.com/stacy_muur/status/2058889644935442468?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">May 25, 2026</a></p>
</blockquote>
<p><strong>The two identified attacker wallets are:</strong></p>
<ul>
 <li>0x37925684BA178821b4436E06e67f5dBD6cfA49Bb</li>
 <li>0x2fC25F46cC49D226eF92E9A7665f3d2821F3c5E2</li>
</ul>
<p>Web3 researcher and GREEND0TS founder <a href="https://x.com/stacy_muur/status/2058889644935442468" rel="noopener noreferrer nofollow">Stacy Muur</a> amplified the warning by sharing screenshots of the malicious advertisement appearing as the top sponsored result for “Uniswap” searches on Google. She noted that the fraudulent site closely replicated the official Uniswap interface.</p>
<p>Similar security concerns have also surfaced recently within the Uniswap ecosystem itself, after attackers reportedly <a href="https://cryip.co/uniswap-v4-router04-exploited-42100-drained-in-on-chain-attack/" rel="noopener noreferrer nofollow">exploited the Uniswap v4 Router04 contract</a> in an on-chain attack that drained nearly $42,100 from affected users, further highlighting the growing risks surrounding DeFi platforms and wallet interactions.</p>
<h2 id="how-the-attack-worked">How the Attack Worked</h2>
<p>The scam followed a simple yet effective method:</p>
<ul>
 <li>Users searching for “Uniswap” on Google saw a sponsored advertisement at the very top.</li>
 <li>Clicking the ad directed them to a professionally designed phishing website that mimicked the real Uniswap app.</li>
 <li>Once users connected their wallets and approved transactions, they unknowingly granted permission to malicious smart contracts.</li>
 <li>These drainer contracts quickly transferred cryptocurrencies and tokens from the victims’ wallets to the attackers’ addresses mentioned above.</li>
</ul>
<p>Attackers reportedly used lookalike domains, hidden iframes, and other techniques to bypass Google’s automated ad reviews.</p>
<h2 id="part-of-a-larger-ongoing-problem">Part of a Larger, Ongoing Problem</h2>
<p>This incident is not isolated. Fake Google Ads have become a persistent attack vector in the crypto space. Security Alliance (SEAL) reported a significant increase in such phishing campaigns in March 2026, during which attackers stole approximately <a href="https://radar.securityalliance.org/malicious-google-ads-targeting-crypto/" rel="noopener noreferrer nofollow">$1.27 million in just a few weeks</a>. The group has blocked over 356 malicious crypto-related Google Ads in recent months.Prominent voices in the crypto community, including Uniswap founder <a href="https://x.com/haydenzadams/status/2024732245370544498" rel="noopener noreferrer nofollow">Hayden Adams</a>, have previously criticized Google for its slow response in removing impersonating advertisements despite repeated reports.</p>
<h2 id="security-recommendations-for-users">Security Recommendations for Users</h2>
<p>To protect themselves, crypto users should follow these precautions:</p>
<ul>
 <li>Never click on sponsored Google Ads when searching for crypto platforms.</li>
 <li>Always access Uniswap and other DeFi sites by manually typing the official URL (app.uniswap.org) or using bookmarks.</li>
 <li>Verify links through official project channels or trusted aggregators like DeFiLlama.</li>
 <li>Use wallet simulators and carefully review transaction details before signing.</li>
 <li>Regularly revoke token approvals using tools like revoke.cash.</li>
 <li>Consider using ad blockers and phishing-protection browser extensions.</li>
</ul>
<p>This latest scam serves as a reminder that while blockchain technology itself is secure, the biggest risks often come from centralized platforms like search engines and human error. Users must remain extremely vigilant when interacting with crypto applications.</p>

Uniswap Users Lose Over $400K in Google Ad Phishing Scam Targeting Crypto Wallets

Table of Contents

CRYIP

Other articles published on May 26, 2026

Join our free newsletter for daily crypto updates!