← Fake Uniswap V4 Airdrop Phishing Network (2026)reviewed 2026-10-15 · 20 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Fake Uniswap V4 Airdrop Phishing Network (2026) against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
2 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #6[disputed][awaiting moderator]in section: Drainer-as-a-Service Tooling: AngelFerno
“AngelFerno had previously been implicated in attacks on OpenEden and Curvance websites before pivoting to Uniswap-themed campaigns.”
reviewerAngelFerno had previously been implicated in attacks on OpenEden and Curvance websites before pivoting to Uniswap-themed campaigns.The page implies OpenEden/Curvance predate the Uniswap campaigns, but Blockaid's own reporting places those incidents in February 2026, after the Uniswap-themed wave had been running for roughly seven months.Proposed correction (not yet applied)AngelFerno has also been implicated in attacks on OpenEden and Curvance websites, hijacked in February 2026 — months after, not before, the kit's Uniswap-themed Google Ads campaigns began. - #9[disputed][awaiting moderator]in section: Ad Cloaking and Infrastructure
“Over the prior year, SEAL reported blocking more than 356 malicious advertisement links.”
reviewerOver the prior year, SEAL reported blocking more than 356 malicious advertisement links (Ad Cloaking and Infrastructure section).SEAL's reporting characterizes 356 as a representative weekly figure maintained over a year, which if accurate implies a much larger cumulative annual total than 356 — the page's 'over the prior year... 356 links' phrasing understates and mischaracterizes the scale.Proposed correction (not yet applied)SEAL reported blocking more than 356 malicious advertisement links in a typical week, a volume it said had held steady for over a year.
unverifiable
2 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #13[unverifiable][awaiting moderator]in the summary
“Verified aggregate losses across the discrete 2025–2026 Google Ads campaign episodes reach approximately $1.63 million”
reviewerVerified aggregate losses across the discrete 2025-2026 Google Ads campaign episodes reach approximately $1.63 million.Could not confirm whether the February 2026 'Ika' incident and the May 2026 $400K 'b-block' incident involve the same victim reported twice by different outlets with different dollar figures, or are genuinely separate episodes. If they are the same event, the page's framing of these as independent, 'discrete' episodes would be questionable, though the $1.63M total itself does not appear to double-count since it only sums the July 2025 and May 2026 figures (the Feb 2026 figure is already excluded as unconfirmed). - #20[unverifiable][awaiting moderator]in section: Malicious Approval Mechanism
“Uniswap Labs confirmed in its official support documentation that the only legitimate Uniswap airdrop occurred on September 1, 2020, and that all subsequent airdrop announcements should be verified exclusively through the official Uniswap Labs or Uniswap Foundation X accounts before any wallet interaction.”
reviewerUniswap Labs' official support documentation states the only legitimate Uniswap airdrop occurred on September 1, 2020.Independent reporting confirms UNI's governance-token distribution used a September 1, 2020 eligibility snapshot, but the token was actually claimable/distributed starting around September 16, 2020 -- so 'the airdrop occurred on September 1, 2020' may conflate the snapshot date with the distribution date. Could not verify the exact support-page wording due to a 403 on direct fetch.
partially supported
2 claimsThe cited evidence supports part of the claim but not all of it.
- #11[partially supported][awaiting moderator]in the timeline
“AngelFerno drainer implicated in the attack.”
reviewerThe July 21, 2025 Google Ads incident involving a $1.23 million loss in Uniswap v3 NFTs is attributed to the AngelFerno drainer.Date and dollar figure are well-supported by the cited source; the specific AngelFerno attribution for this particular incident is not found in the cited article or in other sources consulted and appears to be an unsupported addition. - #17[partially supported][awaiting moderator]in section: Malicious Approval Mechanism
“Protos reported that scammers also deployed Punycode URLs — domains using Cyrillic or other Unicode characters that are visually indistinguishable from 'app.uniswap.org' at a casual glance — to further obscure the phishing nature of the site.”
reviewerAttackers used Punycode URLs with Cyrillic or Unicode characters visually indistinguishable from app.uniswap.org.The general Punycode/Cyrillic technique is confirmed in the cited Protos article; the specific pairing with 'app.uniswap.org' is the page's own illustrative addition, not drawn verbatim from the source.
confirmed
14 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: Overview and Campaign Scope
“The July 2022 fake UNI airdrop: Malicious ERC-20 tokens were airdropped to approximately 73,399 addresses, directing recipients to a spoofed domain (uniswaplp.com). One victim lost approximately $8 million in wrapped bitcoin and USDC from a Uniswap v3 liquidity position after the underlying setApprovalForAll function granted the attacker full redemption rights.”
reviewerIn July 2022, malicious ERC-20 tokens were airdropped to approximately 73,399 addresses via spoofed domain uniswaplp.com, and one victim lost approximately $8 million via a setApprovalForAll exploit.Core facts (address count, domain, exploit mechanism, loss amount) are corroborated across CoinDesk, Bleeping Computer, and Check Point. - #2[confirmed][no action needed]in section: Overview and Campaign Scope
“A fraudster posing as a Uniswap Foundation communications representative successfully convinced several crypto media outlets to publish articles about a fabricated $10 million UNI airdrop timed to coincide with the legitimate Uniswap v4 announcement.”
reviewerA scammer posing as a Uniswap Foundation representative convinced crypto media outlets to publish articles about a fabricated $10 million UNI airdrop tied to the Uniswap v4 announcement in February 2024.Corroborated by CryptoSlate's first-person account and secondary coverage naming DailyCoin and CryptoNews as outlets that published before the scam was identified. - #3[confirmed][no action needed]in section: Malicious Approval Mechanism
“Attackers also exploited the absence of validation between actual sender addresses and the emit function data in smart contracts, causing block explorers to display Uniswap as the apparent transaction sender — a technical obfuscation that increased apparent legitimacy.”
reviewerIn the 2022 attack, lack of validation between sender address and emit function data caused block explorers to display Uniswap as the apparent transaction sender.Independently verified via Check Point's technical writeup of the same incident. - #4[confirmed][no action needed]in section: Drainer-as-a-Service Tooling: AngelFerno
“AngelFerno operates on a revenue-sharing model in which affiliates — the scammers who deploy phishing sites and purchase Google Ads — receive approximately 75–85% of stolen funds, with the remainder retained by the kit's developers.”
reviewerAngelFerno operates a revenue-sharing model giving affiliates approximately 75-85% of stolen funds, with the remainder kept by developers.Directly confirmed by the cited Blockaid article. - #5[confirmed][no action needed]in section: Drainer-as-a-Service Tooling: AngelFerno
“Blockaid documented AngelFerno's distribution network on X (Twitter) between September 2025 and January 2026: 20 distinct X accounts were identified sharing malicious AngelFerno-powered dApps, posting thousands of tweets containing links to 75 separate malicious dApps.”
reviewerBlockaid documented 20 X accounts sharing 75 AngelFerno-powered malicious dApps between September 2025 and January 2026.Figures are the security firm's own detection counts, not independently audited, but accurately represented by the page. - #7[confirmed][no action needed]in section: Drainer-as-a-Service Tooling: AngelFerno
“AngelFerno is distinct from Angel Drainer, an earlier and larger drainer kit that held approximately 42% drainer-market share in Q1–Q2 2024 per Scam Sniffer.”
reviewerAngelFerno is distinct from Angel Drainer, which held approximately 42% of the drainer market in Q1-Q2 2024, per Scam Sniffer.Exact figure match against the primary Scam Sniffer report. - #8[confirmed][no action needed]in section: Broader Drainer Ecosystem Context
“Pink Drainer exited in Q2 2024; Inferno Drainer announced its exit in Q4 2024.”
reviewerPink Drainer exited in Q2 2024; Inferno Drainer announced its exit in Q4 2024.Matches the primary source timeline, though the report frames Inferno's exit as being paired with an Angel takeover, a nuance the page omits without materially changing the claim. - #10[confirmed][no action needed]in section: Ad Cloaking and Infrastructure
“SEAL also identified Uniswap as the most frequently impersonated brand in its dataset, accounting for 41% of all detected malicious sites, followed by Morpho Finance at 31%.”
reviewerSEAL identified Uniswap as the most frequently impersonated brand (41% of detected malicious sites), followed by Morpho Finance at 31%.Confirmed by an independent outlet reporting the same SEAL figures; exact reporting window (March vs. May 2026) varies slightly between outlets, which is a minor, non-material ambiguity. - #12[confirmed][no action needed]in section: Documented Financial Losses (Verified vs. Alleged)
“A trader publicly identified as 'Ika' on X reported losing a mid-six-figure sum (estimated $100,000–$999,999 range; exact amount unconfirmed), reported by Protos.”
reviewerA trader publicly identified as 'Ika' reported losing a mid-six-figure sum in a February 2026 Google Ads incident, prompting a public warning from Hayden Adams.Well corroborated across two independent outlets. - #14[confirmed][no action needed]in section: Broader Drainer Ecosystem Context
“In the broader 2026 environment, CertiK reported $370.3 million stolen across 40 incidents in January 2026 alone, characterizing it as one of the worst months for crypto theft in nearly a year.”
reviewerCertiK reported $370.3 million stolen across 40 incidents in January 2026 alone, one of the worst months for crypto theft in nearly a year.Figure matches the original CertiK report as covered by Cointelegraph; a later upward revision exists but doesn't make the as-reported figure false. - #15[confirmed][no action needed]in the timeline
“Uniswap v4 officially launches on mainnet across 10 chains, following nine independent audits and a $15.5 million bug bounty program. No protocol vulnerabilities found. Legitimate V4 launch removes the anticipatory lure but scammers continue to use the V4 branding.”
reviewerUniswap v4 launched on mainnet on January 31, 2025 following nine independent audits and a $15.5 million bug bounty program, with no protocol vulnerabilities found.Well supported by Uniswap's own blog post; minor one-day date variance across secondary sources is immaterial. - #16[confirmed][no action needed]in section: Official Warnings and Industry Response
“Scam Sniffer's anti-phishing databases are deployed by Binance, Rabby Wallet, Phantom, and Bybit, and the July 2025 $1.23 million incident was reported through Scam Sniffer monitoring.”
reviewerScam Sniffer's anti-phishing databases are deployed by Binance, Rabby Wallet, Phantom, and Bybit.Factually accurate but not actually supported by any source cited in this section (cryptonomist, tradingview, uniswap support, usethebitcoin); the correct attribution would be Scam Sniffer's own site, which is not cited anywhere on the page. - #18[confirmed][no action needed]in section: Ad Cloaking and Infrastructure
“The Security Alliance (SEAL) tracked a significant escalation of these Google Search phishing campaigns beginning in March 2026. In a reporting window of March 13–30, 2026 alone, SEAL attributed $1.27 million in losses to malicious Google advertisements targeting multiple DeFi protocols.”
reviewerSEAL tracked a significant escalation of Google Search phishing campaigns beginning in March 2026, with $1.27 million in losses attributed over March 13-30, 2026.The specific cited article (cryptobriefing.com) is actually a May 26, 2026 piece recapping SEAL's March data rather than a contemporaneous March report, but the figure itself checks out via an equivalent May 2026 article (bitcoinist) covering the same SEAL data. - #19[confirmed][no action needed]in the timeline
“On-chain analyst b-block posts a public warning identifying two attacker wallets holding 146 ETH (~$306,000) linked to the ongoing fake Uniswap Google Ads campaign. Multiple outlets report cumulative losses of at least $400,000 from this campaign wave.”
reviewerOn-chain analyst b-block identified two attacker wallets holding 146 ETH (~$306,000) in the May 2026 Google Ads campaign, with cumulative losses of at least $400,000 reported.Directly confirmed by the cited source.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.