Uniswap founder Hayden Adams warned users about fraudulent ads impersonating the exchange after an investor said they lost their entire crypto holdings by clicking a malicious sponsored search result. The episode shows how paid search placement can become a direct wallet-draining vector when fake sites and fake apps mimic trusted DeFi brands.
The warning came as industry trackers pointed to a surge in scam-linked losses, with January 2026 cited at roughly $370.3 million across hacks, exploits, and scams, including one large social-engineering incident reported at about $284 million. The broader context is that social engineering is scaling faster than many user-defense habits, and attackers are using distribution channels like search ads to shorten time-to-compromise.
These scams are horrible, we’ve been fighting them for years
There were scam Uniswap apps while we waited months for App Store approval
Scam ads keep returning despite years of reporting
They ban 3rd party tools like ublock that combat the issue
The ad economy needs to go https://t.co/KCepOv8zUH
— Hayden Adams 🦄 (@haydenzadams) February 20, 2026
How the scam flow works in practice
Scammers reportedly purchased sponsored placements for Uniswap-related search terms and other high-traffic DeFi brands, pushing malicious links above legitimate results. Once victims clicked through to counterfeit interfaces and connected wallets, attackers could trigger approvals and drain balances within minutes.
Adams said impostor Uniswap apps surfaced even while genuine App Store approvals were still pending, highlighting how review delays can be exploited. That timing gap gives attackers a window to capture users who are actively searching for the real product and are primed to trust familiar branding.
Public accounts cited a mid-six-figure loss from a user identified as “Ika,” described as having “lost everything” after interacting with a fraudulent search ad. The reporting emphasizes that victims often realize the compromise only after approvals have already been granted and balances have been swept.
Why recovery is hard and what changes operationally
The text notes that recovery is typically limited because funds can be moved rapidly across wallets and through mixers, leaving little practical leverage for restitution once transfers settle. In these scenarios, the window for intervention is extremely short, which makes prevention more valuable than post-incident response.
For traders and custodians, the operational response centers on basic hygiene with real impact: verify URLs and app sources, avoid blanket approvals, and treat sponsored links as high-risk. The key control is minimizing what a single approval can authorize, because approvals are the pivot point that turns a click into a full balance wipe.
For platform operators and app stores, the incident highlights the tension between review timelines and brand-abuse risk, and it may intensify calls for faster vetting and clearer provenance signals or tighter ad controls. Until those ecosystem controls improve, users remain the primary defense layer against search-ad social engineering.
