Fake Uniswap website drains crypto wallets as fraudsters pocket $400,000

Uniswap accounted for 41% of tracked malicious websites linked to crypto-phishing campaigns discovered by SEAL researchers in March.

A fake website pretending to be Uniswap is draining funds from multiple crypto wallets. The prominent on-chain analyst, pseudonym known as “b-block,” warned that scammers currently control at least $400,000 in stolen assets.

Users have been advised to rely only on official links and verify protocols via DefiLlama.

Uniswap tops the list of most targeted platforms

The latest update comes a month after security group SEAL reported a significant increase in malicious Google ads targeting crypto users. It revealed that attackers were impersonating popular DeFi platforms, wallets and trading apps to steal funds.

SEAL said it recently blocked over 356 malicious Google ad URLs related to crypto scams, targeting platforms such as Uniswap, Morpho Finance, PancakeSwap, Hyperliquid, CoW Swap, and 1inch users.

According to the report, the attackers used hacked or fraudulently obtained Google advertiser accounts and relied on embedded obfuscation, fingerprinting and iframe delivery systems to bypass Google’s automated controls. Many fake ads used trusted Google services such as sites.google.com and docs.google.com to appear legitimate in search results.

SEAL has identified crypto drainer families, including Inferno Drainer and Vanilla Drainer, as the most common malware used in campaigns. The report states that these tools trick users into signing malicious wallet transactions or entering recovery seed phrases on cloned websites, allowing attackers to take control of wallet assets.

SEAL also added that advanced infrastructure used in the attacks, including Cloudflare Workers, Arweave-hosted payloads, traffic redirection systems, and proxy layers, can intercept Ethereum RPC requests and monitor user activity in real time.

You might also like:

Uniswap was the most spoofed platform, accounting for 41% of malicious sites tracked. Between March 13 and March 30, confirmed and unattributed campaign-related losses exceeded $1.27 million, although the security group said the true figure was likely significantly higher.

Rampant phishing campaigns

While recent Uniswap-related scams primarily involved fake websites and malicious Google ads, a separate phishing campaign earlier this year targeted Ledger users via fraudulent emails. The attack follows a data breach at Ledger’s third-party e-commerce partner, Global-e, which exposed customer contact and order information.

The scammers claimed in emails that Ledger and Trezor had merged and urged users to migrate their wallets through fake websites that asked for 24-word recovery phrases. The phishing pages closely copied the companies’ official branding and messaging styles.

Most recently, Ripple CTO David Schwartz warned of a phishing campaign that sent fake security alerts that appeared to arrive from the official Robinhood messaging system. The emails passed authentication checks because the attackers leveraged Robinhood’s account creation flow, making the messages appear legitimate.

The phishing note claimed a new login from an “iPhone 17 Pro” and prompted users to review suspicious activity via a “Review Activity Now” button, which then directed them to credential theft. Robinhood later confirmed the problem, but said no systems were breached and no funds were affected.