Fake Hyperliquid Google Ad Leads to $550,000 Crypto Theft

The August 13 incident involved a counterfeit website that mirrored the authentic Hyperliquid interface. After the victim interacted with the malicious site and authorized a transaction, the infrastructure automatically executed the theft, splitting the stolen funds among multiple attacker-controlled addresses. Blockchain analysis revealed that 80% of the proceeds were routed to one specific wallet, with smaller portions distributed to secondary accounts.

Salus identified this operation as part of a broader drainer-as-a-service model, where developers provide phishing tools—including malicious scripts and automated contract deployment—to affiliates. These operators focus exclusively on purchasing search engine advertisements and managing victim engagement. The firm’s investigation into the Telegram account @AngelFernoOwner uncovered a suite of tools designed for cross-chain withdrawals, token swaps, and asset consolidation, all operating under an automated revenue-sharing scheme.

Beyond this specific case, the infrastructure linked to these tools has been associated with approximately $52.74 million in cumulative losses. Notable incidents include the September 2025 theft involving UXLINK and an April 2026 domain hijacking of the CoW.fi protocol. Following the Hyperliquid incident, Salus submitted its findings and identified high-risk addresses to relevant organizations to facilitate coordinated blacklisting and further investigative action. Google has since suspended the advertiser responsible for the campaign.