Crypto user loses 550,000 USDC after clicking fake Hyperliquid ad on Google

A crypto user has lost around 550,000 USDC after clicking on a sponsored Google search result for Hyperliquid. Behind the advertisement was not the official website, but a convincingly fake phishing site. After connecting her wallet and carrying out an action, the stablecoins were drained in three transactions. The case shows that even the top result in Google is not automatically trustworthy.

Fake Hyperliquid website appears as a Google ad

The victim searched Google for Hyperliquid because she wanted to move funds from her wallet to the trading platform. Instead of entering the official web address herself, she clicked on the first result.

That result was a paid Google advertisement posing as Hyperliquid. According to the victim, the website behind the ad now looks almost identical to the real platform.

After opening the website, she connected her wallet. According to her own account, around 550,000 USDC was then taken almost immediately. The stolen stablecoins were sent to other addresses in three separate transactions.

Security researcher DarcyAri shared information about the attack and warned about phishing via paid search results.

Remarkably, the victim had come across this scam before. About a year ago she saw advertisements for the same phishing site and even reported them in the Hyperliquid Discord. According to her, the fake website has improved considerably since then and is now barely distinguishable from the official version.

550,000 USDC disappears in three transactions

The victim says she has carried out few on-chain activities over the past eighteen months and is therefore less alert to the safety rules that come with them. After the theft, she called on friends and security experts within minutes.

In the end, she decided not to begin an extensive recovery process. However, she did make the incident public to warn other users against the same attack.

The damage amounts to approximately 550,000 USDC. Because USDC is designed to trade at around $1, that equates to roughly $550.000 in stolen crypto.

The incident also shows how phishing attacks are increasingly less dependent on poorly written emails or clearly suspicious websites. Criminals can buy advertisements and build websites that closely resemble well-known crypto platforms. A prominent position in Google is therefore not proof that a website is official or safe.

Sponsored search results can have serious consequences

For crypto users, the risk is especially high because blockchain transactions generally cannot simply be reversed. Anyone who signs a malicious transaction or grants a harmful permission can lose large amounts of money in a short space of time.

Security researchers therefore advise against opening crypto platforms via sponsored search results. The safer alternative is to enter the official web address manually and then save it as a bookmark.

It also remains important to check the full domain before connecting a wallet and to look carefully at what permission the wallet is requesting.

This attack makes clear just how small the mistake can be. One Google search, one sponsored result and one convincingly fake website were enough in this case to lose about $550.000 in USDC.