A new wave of phishing scams is targeting Aave users, and this time, it’s happening right at the top of Google’s search results.
Over the past few days, fraudulent sponsored ads have appeared above legitimate links, directing users to a fake version of Aave’s official website. Once there, users are prompted to connect their crypto wallets and unknowingly sign malicious transactions handing full control to attackers who can instantly drain their assets.
What’s Happening?
The scam was first flagged by PeckShield Alert in an August 7 post, warning that the ad links lead to a near-perfect clone of the real Aave site. Once users click through, the site urges them to connect their wallet and approve a transaction. What appears to be a routine process is actually a trap: those signatures allow hackers to empty the user’s wallet.
This isn’t a one-off issue. Back in June, Scam Sniffer reported a nearly identical campaign, warning the crypto community about fake Aave ads also appearing high on Google.
The Bigger Problem: Phishing in Crypto Is Surging
This is just one example of a much larger and more dangerous trend in 2025.
According to a recent report by Web3 security firm Hacken, phishing scams have already cost investors over $600 million this year surpassing the full-year losses in 2024. These attacks are growing more polished and more frequent, often relying on social engineering tactics that feel incredibly real.
Other major scams this year include:
- A fake Ripple airdrop featuring a deepfake of the CEO
- A single elderly investor losing $330 million in Bitcoin
- Coinbase users targeted in a scam that cost $100 million
These aren’t isolated events—they’re part of a well-organized, evolving effort by bad actors to exploit everyday investors.
How to Protect Yourself
Even the most cautious users can be caught off guard, especially when fake sites look nearly identical to trusted platforms. But there are a few simple rules that can help keep you safe:
✅ Avoid clicking on sponsored ads—especially for crypto platforms. Stick to direct URLs or use trusted bookmarks.
✅ Double-check the URL—even a single typo or extra character is a red flag.
✅ Think before signing transactions—don’t approve anything you don’t fully understand.
✅ Never share private keys or seed phrases—legit platforms will never ask for them.
Final Thoughts
The fact that scammers are now buying ad space on Google shows how bold and sophisticated these campaigns have become. While platforms and regulators continue working on better security tools, the best defense is still awareness.
Always verify before you connect, click, or sign—and when in doubt, walk away.
Let me know if you’d like a condensed version for a tweet, LinkedIn post, or newsletter snip
