User Loses 550,000 USDC After Clicking Google Ad for Fake Hyperliquid Site

A user lost about 550,000 USDC after clicking a Google sponsored ad that led to a fake Hyperliquid website, according to security firm Salus. According to ChainCatcher, the case used professional theft-service infrastructure linked to the Inferno ecosystem, with services advertised through Telegram accounts offering malicious scripts, automatic fund theft, cross-chain withdrawals, and automated profit splitting.Salus said the phishing group handled ad purchases, deployed the fake entry point, and provided the final receiving address, while the backend automatically split funds after the theft. The group has been linked to a cumulative total of about $52.74 million and to several major phishing incidents, including a second-stage authorization phishing attack on the original UXLINK attacker on September 23, 2025, a hijacked CoW.fi official domain on April 15, 2026, and a fake DApp and fake airdrop authorization phishing attack that stole about 1 million USDT on July 9, 2026. Salus said related evidence and high-risk addresses have been submitted to the relevant authorities.