Phishing Incident on Hyperliquid
A user of the cryptocurrency platform Hyperliquid faced a staggering loss of around $550,000 in USDC on August 13, following interactions with a phishing site highlighted in a Google search advertisement, as detailed by Darcy, a co-founder of FlashRescue.
Details of the Scam
In a detailed post, Darcy pointed to three distinct wallet addresses believed to be managed by the fraudulent actor involved in this incident. Examination of the blockchain data connected to the transactions confirms that approximately 550,019 USDC was distributed among these addresses, but such records alone do not clarify the means through which the victim fell victim to the scam.
According to Darcy, the root of the theft can be traced back to a fraudulent Google advertisement that mimicked Hyperliquid’s branding. In a following investigation, GoPlus Security also recognized two of the implicated wallet addresses in their alerts regarding the scam. The division of the stolen funds involved transfers into three parts: approximately 440,015 USDC, 82,503 USDC, and 27,501 USDC, linked to the addresses 0x98b276…13C55, 0x93b6B2…d6D1, and 0x6fE314…B566.
Google’s Response
The split of the funds is in line with the $550,000 loss estimate made by Darcy, but the direct connection to the Google advertisement remains based on user testimonies identified by research, rather than being solidly established by blockchain evidence. The Security Alliance, abbreviated as SEAL, echoed this sentiment by suggesting that substantiating claims of loss related to specific advertisements demands clear victim evidence alongside other signs of wrongdoing.
In response to the report, Google confirmed that it has suspended the advertiser responsible for the misleading campaign. A representative highlighted the company’s stringent policies against scams, noting that 99% of violating advertisements were intercepted before being published in 2025. In its own Ads Safety report for that year, Google reported blocking or taking down over 8.3 billion ads, as well as suspending nearly 25 million advertiser accounts due to various policy violations, including around 602 million scam-related ads.
Broader Patterns of Fraud
In April, SEAL recorded a broader pattern whereby over 356 fraudulent advertising URLs were blocked within a matter of weeks, noting that 17 of these sites were impersonating Hyperliquid, which made up about 5% of their total identified malicious links. They indicated that scammers frequently utilized hacked or illicitly acquired verified accounts and techniques such as cloaking and fingerprinting to bypass automated security checks. Their advice to crypto users emphasized avoiding access to cryptocurrency services via Google Search, opting instead for reliable bookmarks.
This issue is not isolated; previous reports linked deceptive advertisements impersonating Uniswap to losses exceeding $400,000 in May. SEAL also calculated losses of $1.27 million related to suspect ads between mid-March and March 30. Furthermore, there was an instance involving a Trezor user who lost funds by interacting with sponsored phishing links, prompting Trezor to alert users regarding the risk of trusting such search results.
Conclusion and Ongoing Investigations
It is important to note that investigations have not indicated any breaches within Hyperliquid’s own blockchain or trading system; rather, this incident seems to have targeted the user through a false website before they could engage with the authentic platform. Hyperliquid’s support materials remind users to verify exact website URLs and warn about the potential signs of wallet compromise, such as unauthorized transactions or missing assets.
As of August 14, Google confirmed the suspension of the identified advertiser, while on-chain tracking of the three pertinent addresses remains possible. No formal law enforcement actions or attempts at asset recovery linked to this particular case have been reported to date. Future developments will hinge on either transactions from the aforementioned recipient wallets or the identification of exchanges or services involved, seeking to retrieve more information regarding the incident. Currently, the reported loss of $550,000 is backed by transaction data, yet the precise link to the Google ad continues to be a claim reliant on the insights shared by Darcy from FlashRescue.
