TL;DR
- A Polymarket user loses six figures to a fake Uniswap Google ad.
- The fraudulent ad appeared as a top sponsored search result.
- Hayden Adams calls the situation horrible and demands ad economy reform.
A Polymarket user suffered the loss of hundreds of thousands of dollars in crypto assets after clicking a fake Uniswap advertisement that appeared at the top of Google search results. The affected individual shared the incident publicly, describing the error as a blow to their entire net worth. Dozens of people reacted on social media with messages of support and dismay.
DefiLlama’s founder disseminated the case as a warning to the community. Uniswap creator Hayden Adams echoed the message, calling the situation “horrible” and noting they have fought these types of frauds for years. Adams pointed directly at the industry of fake advertisements that mimic legitimate platforms and stated that “the ad economy needs to go.“
The incident represents another link in a chain of attacks where scammers purchase advertising space on Google to direct users toward fraudulent websites that clone known interfaces. The victim accesses the link, connects their wallet, and signs a malicious transaction. That approval grants attackers control to drain assets or conduct unauthorized operations from the compromised account.
The Fraud Mechanism: AngelFerno and Sponsored Ads
The tool used in this attack goes by the name AngelFerno, a wallet-draining script operating under a “scam-as-a-service” model. The code has appeared in previous attacks against OpenEden and Curvance protocols, and remains active on multiple domains identified on GitHub blocklists.
Attackers employ additional tactics to hinder detection, such as using Cyrillic characters in URLs, also known as Punycode addresses. This method makes the fake address visually identical to the legitimate domain for untrained eyes.
The case reignited criticism toward Google over the persistence of these malicious advertisements. Forensic investigator ZachXBT called for severe consequences against the company for failing to prevent these frauds from appearing.
Analysis firms like Chainalysis and various security researchers have repeatedly flagged sponsored Google ads as a recurring attack vector. In July 2025, another decentralized finance user lost $1.2 million in a nearly identical fraud that also impersonated Uniswap through search advertisements.
Protos attempted to contact the victim to confirm the exact magnitude of the loss but did not receive an immediate response before publication. The affected individual publicly stated they lost a six-figure sum after being fooled by a Google ad.
