A Hyperliquid user lost $550,000 USDC on August 13 after clicking a fraudulent paid Google ad. The search ad was designed to mimic the official Hyperliquid website, trapping the victim into clicking a fake link before they even reached the real platform.
The victim’s half-million-dollar funds were immediately split and sent to three different addresses by the perpetrator. The first wallet, 0x98b276…13C55, held the largest portion of 440,015 USDC, while the wallet 0x93b6B2…d6D1 received 82,503 USDC, and 0x6fE314…B566 received the remaining 27,501 USDC. The loss of funds was first reported by Darcy, co-founder of FlashRescue. Shortly after, security firm GoPlus Security also confirmed the involvement of two of the three recipient addresses of the stolen funds through a separate warning to the public.
Tactics to Deceive Smart Engines
Google responded to the incident by confirming that they have suspended the advertiser’s account. The search company claims its systems prevent over 99% of ad policy violations in 2025. According to the 2025 Ads Safety report, Google blocked 8.3 billion ads and suspended 24.9 million advertiser accounts. Out of these blocked ads, 602 million were specifically stopped for being part of scam attempts.
However, in reality, Google’s automated defenses still have vulnerabilities that hackers can exploit. Documentation from the Security Alliance (SEAL) shows that the attackers did not register as new advertisers. Instead, they compromised and utilized hijacked verified advertiser accounts, then employed layered evasion techniques like cloaking and fingerprinting. This tactic works by displaying a clean webpage when Google’s review bots visit, but immediately redirecting clicks from real users to the phishing website.
An Old Modus Operandi Continues to Repeat
These malicious ad campaigns have a long track record. Last April, SEAL blocked 356 malicious ad URLs targeting the crypto sector within a few weeks. Of the 352 entries recorded during this period, 17 of those URLs were deliberately set up to masquerade as the Hyperliquid interface - accounting for 5% of the widespread phishing links.
The pattern of fund theft via search ads recurs every month. A Uniswap ad spoofing incident caused a $400,000 loss in May. Going further back, SEAL recorded a total of $1.27 million lost to malicious Google ad traps in a short span between March 13 and 30.
Throughout this entire series of events, Hyperliquid’s core infrastructure has proven to be secure and was not breached. The exploit vector originated entirely from the search engine acting as the user’s gateway. For crypto users, SEAL’s security advice is worth holding onto: never access financial applications through Google search boxes. Instead, use browser bookmarks with verified links, as a single careless click can drain all asset holdings in seconds.
Reported from crypto.news.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
