A Hyperliquid user lost approximately 550,000 USDC after a Google-sponsored advertisement directed the victim to a fake version of the decentralized trading platform, with investigators linking the theft infrastructure to the Inferno drainer ecosystem.
How the Attack Worked
Blockchain security firm Salus said the theft took place on Aug. 13 and involved a counterfeit Hyperliquid website promoted through paid Google search results. After tracing the stolen funds and reviewing the infrastructure behind the page, the firm connected the operation to a professional drainer-as-a-service network associated with Inferno.
The service solicited customers through a Telegram account and advertised tools including malicious scripts, administrative panels, approval-command generation, one-time contract deployment, automated draining, cross-chain withdrawals, token swaps and fund consolidation. The service also offered automated revenue sharing, allowing proceeds from successful phishing attacks to be divided among participants without manual transfers.
Automated Fund Splitting
In the Hyperliquid case, Salus attributed separate roles to the phishing group and the backend service. The group bought the sponsored advertisements, deployed the spoofed Hyperliquid entry point, and supplied the address designated to receive the proceeds. Once the victim approved the malicious transaction and the funds were taken, the infrastructure handled the split automatically.
Address 0x98b276...13C55 received 80% of the proceeds, while 0x93b6B2...1d6D1 received 15% and 0x6fE314...B566 received 5%. A fourth address executed the drain. Earlier reporting showed roughly 550,019 USDC moving in three transfers of about 440,015 USDC, 82,503 USDC and 27,501 USDC to attacker-controlled addresses. Google later suspended the advertiser linked to the reported campaign.
Drainer-as-a-Service Ecosystem
The setup follows a model in which phishing operators use ready-made wallet-draining infrastructure while concentrating on advertising, fake websites and victim targeting. Wallet drainer services are built around malicious approvals that allow an attacker-controlled contract to transfer tokens after a user signs a transaction. Developers supply malicious software and share stolen proceeds with affiliates who bring in victims.
Inferno has been tied to other large approval-phishing cases. A May 2026 Coinbase lawsuit covered an anonymous investor who alleged about $55 million in DAI was stolen in August 2024 after interacting with a fake login page using Inferno Drainer. The infrastructure was also linked to a September 2025 UXLINK exploit that moved roughly 542 million tokens and an April 2026 CoW.fi domain hijack that cost one victim about 316,000 USDC.
Scope of Losses
Salus said groups connected to the infrastructure were linked to approximately $52.74 million in total losses across multiple phishing incidents. The firm said all supporting evidence, identified high-risk addresses and related intelligence had been formally submitted to relevant organizations for risk labeling and coordinated action.
The case follows other phishing operations in which attackers copied recognizable crypto brands and used familiar online services to place malicious pages in front of potential victims, highlighting the persistent threat of sponsored advertisement phishing in the crypto industry.
