Hyperliquid users have lost approximately $550,000 after a phishing scheme that exploited Google search advertisements, according to reports by Wu Blockchain and crypto security specialists. Attackers purchased sponsored search ads that displayed Hyperliquid’s official domain or convincing lookalike URLs, directing victims to a fraudulent website designed to steal credentials or trick users into approving malicious transactions.
Darcy, co-founder of digital-asset tracing and recovery firm FlashRescue, posted blockchain data appearing to show three transfers from the victim’s wallet to addresses identified as controlled by the attacker. The stolen funds were denominated in USDC. The phishing site reportedly replicated Hyperliquid’s interface closely, making it difficult for even experienced traders to spot the difference.
The incident is part of a broader pattern of cybercriminals abusing search engine advertising to target crypto platforms. The Block reported on this tactic as early as 2020, when scammers used ads to target users searching for Balancer and Uniswap. More recently, Security Alliance (SEAL), a crypto security nonprofit, said it blocked 356 malicious Google ad URLs over several weeks in April, including several impersonating Hyperliquid. Google suspended the advertiser accounts listed in that report.
SEAL added that attackers sometimes use compromised or illicitly purchased advertiser accounts to evade Google’s automated reviews, and that malicious ads can be online for only minutes before finding a first victim. Beyond Hyperliquid, scammers tend to target high total-value-locked protocols on Ethereum and Solana-native applications such as Jupiter, Raydium, and Pump.fun.
Neither Google nor Hyperliquid immediately responded to requests for comment. Users are urged to type official URLs directly, bookmark trusted addresses, avoid clicking sponsored links, verify every transaction detail, and use hardware wallets where possible.
