- A trader lost a six-figure portfolio via a fake Google ad for Uniswap.
- Attackers use Punycode URLs and fake sites to trick even experienced hardware wallet users.
- Hayden Adams said Uniswap has been battling counterfeit apps and scam ads for years.
Hayden Adams, founder of Uniswap, has warned that crypto phishing scams tied to online advertisements remain a serious threat. This came after a trader lost a mid-six-figure portfolio in a single transaction through a fake Google ad impersonating the protocol.
In a post on X, Adams said the team has been battling counterfeit Uniswap apps and scam ads “for years,” yet fraudulent campaigns continue to resurface. He revealed that fake Uniswap applications even appeared during the months-long wait for official App Store approval, while scam ads kept returning despite repeated reports.
“They ban third-party tools like uBlock that combat the issue,” Adams added, arguing that the digital advertising model “needs to go.”
One Click, Entire Portfolio Gone
The latest victim, a DeFi trader known as @ika_xbt, said he lost his entire mid-six-figure net worth after clicking a sponsored Google result that mimicked the Uniswap interface. The fake website prompted him to connect his wallet and sign a malicious transaction, which would grant attackers access to drain his funds within seconds.
The stolen assets reportedly included holdings stored across two hardware wallets and represented years of trading through volatile market cycles. Friends and associates flooded the comment section with messages of support after the incident became public.
The attack was traced to a wallet-draining tool known as AngelFerno, described as a “scam-as-a-service” operation targeting DeFi users. Similar front-end phishing attacks have previously impersonated other crypto platforms using near-identical website designs and deceptive domain names.
Related: Wallet Poisoning and Phishing Scams Drain Millions in Crypto
Google Ads Under Fire
On-chain investigator ZachXBT called for accountability, claiming aggregate losses linked to Google-hosted phishing ads have reached nine figures. He argued that executives should face consequences for failing to curb the proliferation of malicious sponsored links.
Security firms, including Chainalysis, have previously flagged Google search ads as a major attack vector. In July 2025, a DeFi user reportedly lost $1.2 million in a nearly identical scam involving a fraudulent Uniswap advertisement.
The mechanics are straightforward but devastating. Scammers purchase Google ad placements for search terms like “Uniswap” or “DeFi swap.” Their malicious site appears above the legitimate result. Once a user connects their wallet and signs a transaction, a drain script empties the account.
Developers from DeFiLlama have spent years building tools to reduce phishing risks. One contributor urged users to bypass Google entirely and instead rely on verified DeFi link directories or bookmarked official URLs.
Phishing Infrastructure Evolves
AngelFerno operates across multiple domains, some already flagged on GitHub phishing blocklists. Attackers increasingly use Punycode URLs, which replace characters with visually similar Cyrillic letters. This makes fake domains nearly indistinguishable from legitimate ones at a glance.
This case shows that even experienced traders who use hardware wallets can still fall victim. The victim said the loss wasnt just bad luck but the result of frequent on-chain activity that increased exposure to malicious links.
Uniswap is still one of the most popular decentralized exchanges, letting users swap tokens without giving control to a central platform. But its popularity also makes it a common target for scammers who create fake copies of the site.
As phishing methods become more sophisticated, Adams warns that crypto users must stay alert.