Fake Uniswap Ads on Google Net $400K for Scammers

Scammers have weaponized Google search ads to impersonate Uniswap, siphoning funds from unsuspecting crypto users. On-chain observers say the phishing scheme tied to a Uniswap impersonation has already netted attackers at least $400,000, with two marked wallets holding a combined 146 ETH (about $306,000 at the time), according to Etherscan.

Stacy Muur, founder of the Web3 marketing agency Green Dots, described the tactic as a fraudulent Google-sponsored ad that masquerades as Uniswap. She shared a screenshot of a sponsored result and lamented that Google has effectively allowed such campaigns to proliferate, leading users to counterfeit pages that drain their funds.

Analysts and researchers have long warned that Google ads can become a fertile ground for phishing in crypto. DeFiLlama noted that fake ads on Google are a common source of phishing attacks, and the Security Alliance (SEAL) reported a noticeable uptick in March. SEAL explained that attackers may pay Google directly or hijack legitimate advertiser accounts to run convincing ads that imitate popular crypto protocols, aiming to secure top positions in the “Sponsored results” section and outrank legitimate exchanges.

SEAL’s monitoring underscores a persistent pattern: the ad campaigns outbid authentic crypto brands to reach users at moments of high intent. In its report, the group said it blocked more than 356 malicious advertisement links in a span that indicates attacker activity has continued for more than a year, with a steady stream of reports from affected users. The takeaway is that the campaign is not slowing down, and users should anticipate more aggressive phishing attempts in the Google search environment.

The phishing flow, according to SEAL, relies on seemingly legitimate URLs that bypass automated checks, paired with a hidden secondary iframe that loads the malicious payload. Victims are redirected to clones that resemble real crypto apps, while all network traffic is funneled through attacker-controlled servers. SEAL’s timeline shows that between March 13 and March 30, about $1.27 million in funds were stolen across related campaigns.

The broader crypto-security community notes that these incidents fit a wider trend. In early May, reports emerged that attackers were abusing Google Ads and legitimate shared chats from AI chat services in malvertising campaigns targeting Mac users. Separately, Malwarebytes highlighted a separate menace on Facebook, where paid ads mimicked official Windows promotions to steal passwords and crypto wallets, illustrating how scammers routinely exploit mainstream platforms to reach crypto holders.

Key takeaways

• Uniswap-imitation phishing ads on Google have drained at least $400,000 from wallets, with two wallets holding 146 ETH (~$306,000) at proxy valuation.
• Researchers describe ads that impersonate popular protocols aiming for top placement in Google’s Sponsored results, often by hijacking advertiser accounts or paying Google directly.
• SEAL reports a persistent, high-volume threat: hundreds of malicious Google Ads blocked (356-plus), indicating ongoing attacker activity for more than a year.
• The attack chain relies on legitimate-looking URLs and hidden iframes that load the malicious payload, delivering victims to near-perfect clones of real crypto apps.
• Estimates show roughly $1.27 million was stolen in a window from March 13–30 during these campaigns, underscoring the scale of malvertising-driven crypto theft.

Mechanics, scale, and implications for users

At the heart of the Uniswap impersonation are deceptive sponsored search results that appear above authentic links. By surfacing convincing, crypto-brand-like pages, attackers lure users who click through to a counterfeit interface that mirrors the real protocol. Once users input credentials or approve transactions, funds are routed to attacker-controlled wallets rather than the intended smart contract or wallet address. The technique often leverages legitimate-looking URLs to slip past automated screening, with a hidden iframe carrying the malicious payload, making detection harder for both users and some automated defenses.

The immediate impact is tangible: a notable sum of stolen funds tied to a single phishing operation, concentrated in a small number of wallets, and a broader pattern of repeated incidents across different platforms. The two wallets holding 146 ETH—valued around $306,000 at the time of reporting—illustrate how quickly a targeted phishing effort can consolidate proceeds. While the exact distribution of losses across campaigns varies, the public dashboards and on-chain data highlight the material risk to individuals who rely on familiar brands and quick search results to navigate DeFi.

Researchers emphasize that this is not an isolated incident. DeFi analytics group DeFiLlama has observed that counterfeit ads on Google are a recurrent route for phishing, and SEAL’s quarterly activity suggests a continuing arms race between attackers and platform defenses. The group’s data also underscores a mismatch between user intent and platform safeguards: highly targeted ads appear legitimate enough to draw clicks from users who are seeking legitimate crypto services, creating a stealthy threat vector that thrives on brand recognition and proximity to real services.

Broader context: ad-based phishing across platforms

Beyond Google, the ecosystem has seen parallel concerns about malvertising and brand impersonation. In May, reports tied the abuse of Google Ads to broader campaigns that leveraged AI chat tools like Claude to propagate malware to Mac devices, signaling an ecosystem-wide risk from cross-channel abuse. Meanwhile, cybersecurity researchers have flagged paid social ads—most notably on Facebook—that mimic official software promotions to trick users into downloading malware or exposing crypto credentials. These patterns reinforce a single point for users and builders: the attack surface of crypto ecosystems extends beyond on-chain exploits to the very channels people use to discover and engage with services.

Industry observers stress that while tech platforms can tighten vetting and ad screening, attackers adapt quickly. For users, the takeaway is to maintain skepticism around sponsored results, verify the exact URL, and navigate to protocol sites through bookmarks or verified app stores rather than through search results alone. For projects and ad platforms, the challenge is to raise the barrier for fraudulent ads without stiflying legitimate discovery in a rapidly evolving ecosystem.

Conversations within the community also underscore the need for improved attribution and education. While on-chain data can reveal where funds flow, correlating that with phishing campaigns requires cross‑platform collaboration and timely incident reporting. Public threads and reports from researchers—such as those on X by b-block and commentary from industry observers—play a crucial role in raising awareness, even as the scale of losses continues to evolve.

As the ecosystem absorbs these developments, investors and users should monitor ongoing advisories from security groups and analytics firms. The central question remains: will platform operators and regulators implement more robust ad-verification measures to curb malicious impersonation, or will attackers continue to refine their methods to stay one step ahead?

What to watch next: expect continued scrutiny of ad platforms’ handling of crypto-related sponsored content, plus ongoing reporting from analysts on the effectiveness of mitigations. Users should practice due diligence—confirm URLs through direct navigation, disable auto-fill on unfamiliar pages, and employ hardware wallets or session-based approvals where possible. The convergence of on-chain risk and off-chain phishing underscores a broader lesson for the market: security must be designed into every touchpoint, not left as an afterthought.

Source links and attributions: on-chain analysis by b-block (X post), observations from Stacy Muur (X post), DeFiLlama’s notes on fake ads, SEAL’s phishing reports and incident data, and related coverage on malvertising activity across Google Ads and social platforms.

The next phase will likely hinge on how quickly platforms adapt to these tactics and how effectively users adopt safer discovery and authentication practices amid a growing and increasingly sophisticated phishing landscape.