A malicious ad impersonating Hyperliquid has surfaced on Google, tricking DeFi users into connecting wallets and signing away their assets.
These attacks rely on precision-cloned domains and malicious smart contract approvals; no seed phrase needed.
Scam Sniffer confirmed the exploit is live, with real user funds at risk. The bigger story? This is part of a rising trend: wallet drainer scams now eclipse protocol hacks in total value stolen.
These Google ad-based exploits are part of a growing trend known as Pig Butchering, where scammers create fake dashboards or investment fronts to “fatten” users before draining their wallets through deceptive permissions.
According to Scam Sniffer, these scams aren’t isolated: wallet drainers have drained $494 million from over 300,000 wallets in 2024, a 67 percent year-over-year increase.
Sophistication in Scale: Cloned Domains and Fake Branding
Scammers are cloning official Web3 project domains and matching tired branding to deceive even discerning users.
These look-alike sites reproduce layout, naming, and interaction flows to create a false sense of legitimacy.
In the case of Hyperliquid, the site mimics the official interface enough to lure users into granting “approval” permissions — an action that executes a smart contract draining assets under the radar.
This attack vector has become the dominant threat model in DeFi, surpassing protocol hacks.
Notably, Scam Sniffer reported 30 wallet‑drainer scams in 2024. The total amount exceeded $1 million, with the largest single theft netting $55.4 million.
Ethereum was the primary target, accounting for more than $152 million, nearly 89 percent of the total loss from large-scale drainers.
Beyond the Phishing Trap: No Seed Phrases, Just Signatures
Unlike traditional wallet phishing that steals seed phrases, these auto-drainers rely on malicious smart contract approvals.
Users land on the cloned site, connect their wallet through WalletConnect or injected Web3 libraries, and approve transactions; often with subtle permissions like “collectibles” or “manage assets.”
Once signed, billions of dollars pass through, sometimes behind the scenes, in seconds.
Check Point Research recently exposed a similar mobile attack: a fake WalletConnect app on Google Play gathered over 10,000 installs, siphoning around $70,000 in crypto. That malware evaded detection for five months, demonstrating the sophistication of the latest threats.
This isn’t an isolated case: similar fake ads for Solscan (April 26) and Aave (June 20) also topped Google results, as flagged by Scam Sniffer, using identical wallet-drainer tactics.
When Wallet Drainers Outpace Hacks
In 2024, wallet drainer scams alone cost victims nearly $494 million, approaching total losses from DeFi hacks and bridge exploits.
Unlike high-profile hacks, drainers target individuals across the spectrum, strategically scaling up success by the sheer number of compromised wallets.
This marks a fundamental shift in risk: losses now arise from exploitative UX and deceptive web practices, not just code vulnerabilities
What This Means for Users and Platforms
Crypto users must now scrutinize URLs, even when they appear official. Verifying domain authenticity, avoiding ads for direct wallet connections, and checking token approvals are essential.
Web3 infrastructure providers should also enforce additional UX barriers, like transaction confirmation warnings and approval notifications.
Monitoring and analytics solutions deserve fresh attention. As Scam Sniffer and Chainalysis confirm, wallet-drainer (pig butchering) attacks are the largest single source of wallet theft in 2024.
