A phishing attack via Google: Hyperliquid trader loses $550,000 in USDC
Another victim of decentralized finance — a trader on the Hyperliquid platform — lost approximately $550,000 in the USDC stablecoin. The cause was a phishing scheme launched through advertisements in the Google search engine.
The attackers placed an advertising banner in Google search results that led to a fake web resource fully replicating the Hyperliquid interface. Visually, the site was indistinguishable from the original decentralized exchange, which misled the user. After the trader connected their wallet and made a series of transactions on the fake platform, the funds were instantly withdrawn to addresses controlled by the hackers.
This incident highlights a systemic problem in the crypto industry: advertising platforms, including Google, continue to serve as a channel for large-scale phishing campaigns. Despite moderation efforts, attackers find ways to bypass filters using sophisticated link masking and website cloning techniques.
For users of DeFi protocols, this is a warning sign. Even experienced traders can fall for the trap if they do not manually check the domain name and do not use hardware wallets with additional transaction verification. It is recommended to always enter the exchange address manually, add it to bookmarks, and ignore advertisements in search engines.
My comment: Such attacks are a direct threat to trust in the DeFi ecosystem. Until platforms implement stricter protection mechanisms, such as domain verification via DNS or integration with anti-phishing services, users remain the primary target. Always check the URL before connecting your wallet — this is the only reliable barrier in conditions where advertising networks fail to filter effectively.