Fake Hyperliquid Google ad linked to Inferno drainer steals USDC

cryptonews16:15

A Hyperliquid user has lost about 550,000 USDC after a Google sponsored advertisement directed the victim to a fake version of the decentralized trading platform, with investigators linking the theft ...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2661221962?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-08-24 16:15","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2661221962","market":"sg","top_or_hot":-1,"title":"Fake Hyperliquid Google ad linked to Inferno drainer steals USDC","media":"cryptonews","content":"<div>\n<p>A Hyperliquid user has lost about 550,000 USDC after a Google sponsored advertisement directed the victim to a fake version of the decentralized trading platform, with investigators linking the theft ...</p>\n\n<a href=\"https://crypto.news/fake-hyperliquid-google-ad-linked-to-inferno-drainer-steals-usdc/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>Fake Hyperliquid Google ad linked to Inferno drainer steals USDC</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nFake Hyperliquid Google ad linked to Inferno drainer steals USDC\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-08-24 16:15 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/fake-hyperliquid-google-ad-linked-to-inferno-drainer-steals-usdc/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>A Hyperliquid user has lost about 550,000 USDC after a Google sponsored advertisement directed the victim to a fake version of the decentralized trading platform, with investigators linking the theft ...</p>\n\n<a href=\"https://crypto.news/fake-hyperliquid-google-ad-linked-to-inferno-drainer-steals-usdc/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":null,"symbol_name":null,"start_time":0,"source_url":"https://crypto.news/fake-hyperliquid-google-ad-linked-to-inferno-drainer-steals-usdc/","article_id":"2661221962","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/fake-hyperliquid-google-ad-linked-to-inferno-drainer-steals-usdc/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2661221962","pubTimestamp":1787559342,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"A Hyperliquid user has lost about 550,000 USDC after a Google sponsored advertisement directed the victim to a fake version of the decentralized trading platform, with investigators linking the theft infrastructure to the Inferno drainer ecosystem.A Hyperliquid user lost about 550,000 USDC after clicking a Google sponsored ad for a fake website.Salus linked the attack infrastructure to the Inferno drainer ecosystem.The backend automatically split the stolen funds among addresses tied to the operation.Blockchain security firm Salus said in an Aug. 24 post on X that the theft took place on Aug. 13 and involved a counterfeit Hyperliquid website promoted through paid Google search results. After tracing the stolen funds and reviewing the infrastructure behind the page, the firm said it connected the operation to a professional drainer-as-a-service network associated with Inferno.On August 13, 2026, a fake Hyperliquid website promoted through Google sponsored ads caused a victim to lose 550","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{},"translate_title":"与 Inferno drainer 相关的虚假 Hyperliquid Google 广告窃取 USDC","themeId":null,"isJumpTheme":false,"ttsUrl":"https://static.tigerbbs.com/68a1585d54cba3796593712e084d4972","symbols_score_info":{"SKYY":0.6,"VOX":0.6,"GOOX":0.6,"GOOGL":1.85,"GOU":0.6,"CMAG":0.6,"TRUC":0.6,"GOGL":0.6,"OGIG":0.6,"GOOW":0.6,"SNPE":0.6,"EFIV":0.6,"GOOY":0.6,"XDAT":0.6,"ILDR":0.6,"CQTM":0.6,"LTL":0.6,"GGLL":0.6,"METV":0.6,"XLC":0.6,"GXPC":0.6,"FCOM":0.6,"GOOL":0.6,"GOOP":0.6,"GGLS":0.6},"content_text":"A Hyperliquid user has lost about 550,000 USDC after a Google sponsored advertisement directed the victim to a fake version of the decentralized trading platform, with investigators linking the theft infrastructure to the Inferno drainer ecosystem.\n\n\nSummary\n\n\n\nA Hyperliquid user lost about 550,000 USDC after clicking a Google sponsored ad for a fake website.\nSalus linked the attack infrastructure to the Inferno drainer ecosystem.\nThe backend automatically split the stolen funds among addresses tied to the operation.\nGroups linked to the infrastructure were connected to about $52.74 million in losses.\n\n\n\nBlockchain security firm Salus said in an Aug. 24 post on X that the theft took place on Aug. 13 and involved a counterfeit Hyperliquid website promoted through paid Google search results. After tracing the stolen funds and reviewing the infrastructure behind the page, the firm said it connected the operation to a professional drainer-as-a-service network associated with Inferno.\n\nOn August 13, 2026, a fake Hyperliquid website promoted through Google sponsored ads caused a victim to lose 550k USDC.After cross-checking the subsequent fund flows, we confirmed that the case involved professional drainer-as-a-service infrastructure closely linked to the…— Salus (@salus_sec) August 24, 2026\n\nHyperliquid phishing case used automated theft infrastructure\nSalus said its undercover investigation found that the service solicited customers through the Telegram account @AngelFernoOwner. The operator advertised tools including malicious scripts, administrative panels, approval-command generation, one-time contract deployment, automated draining, cross-chain withdrawals, token swaps, and fund consolidation.\nThe service also offered “automated revenue sharing,” according to the security firm, allowing proceeds from successful phishing attacks to be divided among participants without manual transfers.\nIn the Hyperliquid case, Salus attributed separate roles to the phishing group and the backend service. The group bought the sponsored advertisements, deployed the spoofed Hyperliquid entry point, and supplied the address designated to receive the proceeds. Once the victim approved the malicious transaction and the funds were taken, the infrastructure handled the split automatically.\nAccording to Salus, address 0x98b276…13C55 received 80% of the proceeds, while 0x93b6B2…1d6D1 received 15% and 0x6fE314…B566 received 5%. A fourth address, 0x9bcd…9104a, executed the drain.\nEarlier reporting on the Aug. 13 incident showed roughly 550,019 USDC moving in three transfers of about 440,015 USDC, 82,503 USDC and 27,501 USDC to addresses identified by security researchers as attacker-controlled. Google later suspended the advertiser linked to the reported campaign, according to reports published after the theft.\nDrainer-as-a-service model provides ready-made phishing tools\nThe setup described by Salus follows a model in which phishing operators can use ready-made wallet-draining infrastructure while concentrating on advertising, fake websites, and victim targeting.\nAs crypto.news explained in July 2026, wallet drainer services are built around malicious approvals that allow an attacker-controlled contract to transfer tokens after a user signs a transaction. The report also described drainer-as-a-service operations as an industry in which developers supply malicious software and share stolen proceeds with affiliates who bring in victims.\nSuch infrastructure can separate the visible phishing campaign from the software used to process approvals and move assets. In the latest case, Salus said the advertised package covered both the initial draining tools and later stages such as cross-chain withdrawals, swaps, consolidation, and profit distribution.\nInferno has been tied to other large approval-phishing cases. A May 2026 Coinbase lawsuit report covered an anonymous investor who alleged that about $55 million in DAI was stolen in August 2024 after the victim interacted with a fake login page. The complaint said the attacker used Inferno Drainer, while blockchain security firm Zero Shadow later traced part of the stolen assets to a Coinbase retail account.\nSalus links infrastructure to $52.74 million in losses\nTracing beyond the Hyperliquid victim, Salus said groups connected to the infrastructure were linked to approximately $52.74 million in total losses across multiple phishing incidents.\nOne of the largest cases cited by the firm involved the attacker behind the September 2025 UXLINK exploit. On Sept. 23, 2025, the attacker later became the victim of an approval-phishing attack that moved roughly 542 million UXLINK tokens.\nA September 2025 UXLINK phishing report said ScamSniffer detected a malicious increaseAllowance approval that enabled phishing addresses to drain more than $43 million worth of UXLINK at the time. SlowMist founder Yu Xian said the theft was likely carried out by Inferno Drainer using an authorization-phishing method.\nThe phishing incident followed the original UXLINK compromise one day earlier. Attackers had exploited a delegateCall vulnerability in the project’s multi-signature wallet, obtained administrator privileges, and moved about $11.3 million in assets, while unauthorized token minting caused further disruption. The later phishing theft removed hundreds of millions of UXLINK from the exploiter’s own wallet.\nSalus also linked the infrastructure to an April 15, 2026 incident involving CoW.fi. According to the security firm, the protocol’s official domain was hijacked, and one associated victim lost about 316,000 USDC.\nA third incident cited by Salus occurred on July 9, when a suspected fake decentralized application or fake airdrop prompted a malicious approval that resulted in the theft of 999,999 USDT. ScamSniffer had reported the transaction, according to the firm’s account of the case.\nEvidence and high-risk addresses sent for action\nThe Hyperliquid case follows other phishing operations in which attackers copied recognizable crypto brands and used familiar online services or development platforms to place malicious pages in front of potential victims.\nA March 2026 OpenClaw phishing report described attackers creating fake GitHub accounts and cloned websites before directing developers to malicious wallet-connection prompts. OX Security said the campaign used obfuscated code and targeted users with fake token offers, although no confirmed victims had been reported at the time.\nFor the Aug. 13 Hyperliquid theft, Salus said its investigation covered the subsequent fund flows, the service infrastructure and the accounts used to recruit phishing operators. The firm said all supporting evidence, identified high-risk addresses and related intelligence had been formally submitted to relevant organizations for risk labeling and coordinated action.\n\n\n\n\n\n                Read more:\n            \n\n                Upbit, Bithumb place SAND under caution after bridge exploit","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"0","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"isLaohu8Offline":false,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.47.1","shortVersion":"4.47.1","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2661221962","isCrawlerRequest":true}