Google ad phishing scam drains $550,000 from Hyperliquid user, security specialist says

A Hyperliquid user appears to have lost roughly $550,000 in USDC after falling victim to a phishing scam promoted through a Google search ad, according to a crypto security specialist.Darcy, co-founder of digital-asset tracing and recovery firm FlashRescue, posted blockchain data appearing to show three transfers from the user’s wallet to addresses he identified as controlled by the attacker. Darcy attributed the loss to a paid Google ad that directed the user to a website impersonating Hyperliquid.Malicious search ads have long been used to target crypto users. The Block reported on the tactic as early as 2020, when scammers were buying ads that directed users searching for platforms such as Balancer and Uniswap to look-alike websites designed to steal private keys or obtain malicious wallet approvals.It doesn't appear that Google has taken many measures to combat the activity. In April, crypto security nonprofit Security Alliance (SEAL) said it had blocked 356 malicious Google ad URLs over a period of several weeks, including several impersonating Hyperliquid. SEAL said Google had suspended all the advertiser accounts listed within its report.Aside from Hyperliquid, scammers tend to target high total value locked protocols on Ethereum or Solana-native applications like Jupiter, Raydium and Pump.fun, SEAL added.In its report, SEAL also said attackers sometimes use compromised or illicitly purchased advertiser accounts in order to evade Google’s automated reviews."Often, an ad is online for only minutes before finding its first victim. High-value losses motivate attackers to persist with deployments, regardless of the temporary sunk costs caused by SEAL's takedown efforts," the firm said.Google and Hyperliquid didn't immediately respond to a request for comment.Disclaimer: The Block is an independent media outlet that delivers news, research, and data. As of November 2023, Foresight Ventures is a majority investor of The Block. Foresight Ventures invests in other companies in the crypto space. Crypto exchange Bitget is an anchor LP for Foresight Ventures. The Block continues to operate independently to deliver objective, impactful, and timely information about the crypto industry. Here are our current financial disclosures.© 2026 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.