Phishing Site Impersonating Uniswap Drains $400,000

On-chain investigator b-block posted an alert on X that a phishing site impersonating Uniswap drained about $400,000 from multiple wallets. The stolen funds were moved into two flagged addresses: 0x37925684BA178821b4436E06e67f5dBD6cfA49Bb and 0x2fC25F46cC49D226eF92E9A7665f3d2821F3c5E2.

The alert urged users to access decentralized finance protocols only through official links and to verify web addresses before signing transactions. The investigator recommended traders avoid signing approvals on unfamiliar sites and to cross-check URLs.

Phishing attacks in DeFi typically copy legitimate front-end interfaces, buy search ads that point to lookalike domains, and prompt users to sign approvals that grant scammers access to tokens. Security firms list cloned interfaces and malicious signature requests as common attack methods.

Hayden Adams, Uniswap’s founder, called the scams “horrible” and noted fraudulent apps impersonating the protocol reappeared while the company awaited App Store approval.

The FBI’s 2025 Internet Crime Report recorded 181,565 cryptocurrency-related complaints with $11.36 billion in reported losses, a 22% increase from 2024, and an average loss of $62,604 per reported crypto fraud victim. The report logged 7,164 complaints tied to phishing and spoofing with more than $111 million in losses. Blockchain security firm Scam Sniffer reported that signature phishing attacks siphoned $6.27 million from wallets in the first month of the year.

Security guidance includes revoking unused token approvals, always verifying that a site’s URL matches the official protocol address, and avoiding sponsored search results that may link to fraudulent pages. Users can also use hardware wallets and browser extensions with domain-blocking features to reduce the risk of accidental approvals.

The two flagged addresses are public on-chain, allowing investigators to trace fund movement and search for links to mixers or other services. Representatives for Uniswap and Google were contacted for comment.