Uniswap Google Ad Phishing Campaign (May 2026)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·2JEQL8…ugKFSummary
An active phishing campaign exploiting Google Search sponsored advertisements to impersonate the Uniswap decentralized exchange was publicly exposed on May 25, 2026, by on-chain analyst b_block_oficial. Attackers operating two identified Ethereum wallets have allegedly stolen over $400,000 from multiple victims by deploying wallet-drainer malware services (Inferno Drainer and Vanilla Drainer), which siphon assets after victims approve malicious smart contracts on cloned Uniswap interfaces. The Security Alliance (SEAL) has confirmed blocking 356+ related fraudulent advertisement URLs and describes the broader Google Ads phishing trend as active and ongoing for more than a year.
Connected Entities
11 entities · 60 linked investigations- Uniswap Google Ad Phishing Campaign (May 2026)→mentioned with→Uniswap(80%)
- Uniswap Google Ad Phishing Campaign (May 2026)→mentioned with→Jupiter Exchange(60%)
- Uniswap Google Ad Phishing Campaign (May 2026)→mentioned with→Phantom Wallet(60%)
- Uniswap Google Ad Phishing Campaign (May 2026)→mentioned with→Ethereum(60%)
- Uniswap Google Ad Phishing Campaign (May 2026)→mentioned with→Hyperliquid(60%)
- Phantom Wallet→mentioned with→Ethereum(70%)
- Hyperliquid→mentioned with→Uniswap(60%)
- Hyperliquid→mentioned with→Ethereum(70%)
- Uniswap→mentioned with→Ethereum(80%)
- Inferno Drainer→mentioned with→Ethereum(70%)
- + 15 more
Community submissions
“May 25-26, 2026: $400K+ stolen via fake Uniswap Google search ads. Sites targeted multiple DeFi front-ends. Uses malicious smart contract approval signatures. Continuation of March 2026 campaign ($1.27M+).”
— avoid-scout(unverified)
Timeline(8 events)
21 July 2025
A single DeFi user loses over $1.23 million in Uniswap V3 Position NFTs after signing a malicious transaction on a phishing site promoted via Google Ads.
Phemex News / Crypto.newsFebruary 2026
Uniswap founder Hayden Adams publicly acknowledges years of ongoing phishing attempts targeting Uniswap users and criticizes search platforms for inaction on scam ads.
Crypto BriefingMarch 2026
Google Search fraudulent site impersonating Uniswap reported ranking at top of search results; SEAL documents a sharp increase in malicious Google advertising campaigns targeting crypto.
BeInCrypto / SEAL Radar13 March 2026
Start of SEAL's tracked window: malicious Google Ads campaign targeting Uniswap, Morpho Finance, PancakeSwap, and others begins intensive phase.
Security Alliance (SEAL) Radar30 March 2026
End of SEAL's tracked window: 356+ fraudulent URLs blocked; $810,929 in confirmed tracked losses; estimated total $1,274,259 stolen across the campaign during this period.
Security Alliance (SEAL) Radar21 April 2026
SEAL publishes detailed report on malicious Google Ads targeting crypto, naming Uniswap as the primary target (41% of 352 blocked URLs), identifying Inferno Drainer and Vanilla Drainer as the tools used, and documenting compromised advertiser accounts.
Security Alliance (SEAL) Radar25 May 2026
On-chain analyst b_block_oficial publicly exposes the active Uniswap Google Ad phishing campaign on X, identifying attacker wallets 0x37925684BA178821b4436E06e67f5dBD6cfA49Bb and 0x2fC25F46cC49D226eF92E9A7665f3d2821F3c5E2 holding approximately 146 ETH (~$306,000).
CryptoTimes / BeInCrypto26 May 2026
Multiple crypto media outlets report on the campaign; total losses confirmed at over $400,000; SEAL's blocking of 356+ fraudulent ad URLs publicly noted; campaign described as active and ongoing.
CoinTelegraph / CryptoTimes / BeInCrypto / Crypto BriefingDecision Log
- slot 423214566 · hash 2J1yVi6iTUNjswKX9appZ2xcvBgB2LRLHa1fzFt9eP5R
- slot 423214563 · hash ACc4Ki3T9jUrXFDyBJwVzG94o9UkgVyiefMoBHs4Hbjm
- slot 423150266 · hash FvYmK1W2uacbqLLyJxNm5hDwLEWhyDaJGSmkkKwa4Awo
- slot 423150261 · hash 6stKpatmFjGxffz9E3RCaFBYDuNcqDzaAoTutakfR3fP
- slot 422339653 · hash 7wymHih4EMUaGUrsTtoU7izvDD5dzaARoWD6nxtFGoqV
This investigation is cryptographically anchored to the Solana blockchain (5 decisions). 7 of 9 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/26/2026, 6:35:32 PM
last updated: 8/2/2026, 10:16:32 AM
6 viewsavoid.net — verified advice for a post-truth world