A Hyperliquid user lost roughly $550,000 in USDC after clicking a malicious Google search advertisement on Aug. 13. FlashRescue co-founder Darcy reported the incident and identified three addresses allegedly controlled by the attacker, with blockchain data confirming transfers of approximately 440,015 USDC, 82,503 USDC, and 27,501 USDC to these addresses. The attack appears part of a broader campaign targeting crypto users through fraudulent sponsored search results, with Security Alliance documenting 356 malicious advertising URLs earlier this year including 17 websites impersonating Hyperliquid.
Blockchain Data Confirms Three-Address Transfer Pattern
Blockchain data showed approximately 550,019 USDC moving to three addresses identified by Darcy. The transfers included movements of roughly 440,015 USDC, 82,503 USDC, and 27,501 USDC. The transfers confirm that the funds moved, but do not independently prove how the victim was deceived. The connection to the fraudulent Google advertisement comes from Darcy's investigation and reported victim evidence.
Google Suspends Advertiser After Incident Report
Google suspended the advertiser associated with the campaign. The company stated it has zero tolerance for scams and said its systems prevented more than 99% of policy-violating advertisements from running in 2025. Google separately reported removing or blocking more than 8.3 billion ads last year, including 602 million linked to scams.
Security Alliance Documents 356 Malicious Ad URLs
Security Alliance documented 356 malicious advertising URLs earlier this year, including 17 websites impersonating Hyperliquid. The organization said malicious Google Ads have been deployed at a steady rate for more than a year, with attackers frequently switching between major DeFi brands. SEAL recorded approximately $1.27 million in confirmed and suspected losses from malicious Google advertising between March 13 and March 30 alone, and warned that the true figure is likely higher.
Attackers Deploy Cloaking Systems to Bypass Security Checks
Some campaigns use hacked or illegally purchased verified advertiser accounts alongside cloaking systems designed to fool automated security checks. SEAL found attackers using trusted Google-hosted pages as an initial layer before loading malicious content through secondary frames. This allows the page shown to security systems to differ from what a targeted victim receives. The organization has also noticed crypto drainers using browser-based JavaScript to persuade victims to sign malicious transactions. There is currently no public evidence establishing which drainer technology was used in the latest Hyperliquid incident. There is no evidence that Hyperliquid's protocol was compromised.
FAQ
What happened to the Hyperliquid user on Aug. 13?
A Hyperliquid user lost roughly $550,000 in USDC after clicking a malicious Google search advertisement that directed them to a website impersonating the crypto trading platform. FlashRescue co-founder Darcy reported the incident and identified three addresses allegedly controlled by the attacker.
How many malicious ads impersonating crypto platforms did Security Alliance find?
Security Alliance documented 356 malicious advertising URLs earlier this year, including 17 websites impersonating Hyperliquid. The organization recorded approximately $1.27 million in confirmed and suspected losses from malicious Google advertising between March 13 and March 30 alone.
