Key Points

• Fraudulent Uniswap advertisements on Google Search successfully stole more than $400,000 from cryptocurrency investors
• Blockchain analysis revealed two suspicious wallet addresses containing approximately 146 ETH, valued at roughly $306,000
• SEAL (The Security Alliance) identified and blocked more than 356 dangerous ad links, with total losses reaching $1.27 million from March 13 through March 30
• Cybercriminals evade Google’s automatic screening by deploying authentic-appearing URLs combined with concealed iframes
• Malicious cryptocurrency advertisements have persisted as an ongoing threat for more than twelve months without meaningful reduction

Cybercriminals have orchestrated a sophisticated advertising campaign on Google Search that mimics Uniswap, a widely-used decentralized cryptocurrency platform. This fraudulent operation has successfully drained a minimum of $400,000 from unsuspecting victims who interacted with the deceptive advertisements.

Blockchain researcher known as “b-block” raised alarm bells on X, cautioning that a counterfeit Uniswap platform was systematically emptying funds from numerous digital wallets. Stacy Muur, who leads the Web3 marketing firm Green Dots, corroborated these findings and published evidence showing the fraudulent sponsored listing appearing prominently on Google.

“The fact that Google has allowed this problem to persist for years while fraudulent links consistently rank above legitimate ones and victims continue losing money is absolutely unacceptable,” Muur stated.

According to Etherscan records, two wallet addresses marked as suspicious contained approximately 146 ETH, representing about $306,000 in value when documented.

The Mechanics Behind the Fraud

The perpetrators employ one of two strategies: either purchasing Google Ads accounts outright or compromising existing legitimate advertiser profiles. They subsequently launch deceptive advertising campaigns that outbid authentic cryptocurrency platforms for premium positioning in the “Sponsored results” segment of Google Search.

These advertisements utilize convincing URLs designed to circumvent Google’s automated verification processes. An invisible secondary iframe subsequently loads the harmful code, which remains undetectable by Google’s monitoring infrastructure.

Upon clicking these advertisements, victims are redirected to meticulously crafted replicas of genuine crypto applications. Every network communication is covertly redirected through infrastructure controlled by the attackers, facilitating the theft of wallet contents.

DeFiLlama verified that fraudulent Google advertisements represent a prevalent phishing technique within cryptocurrency circles. SEAL (The Security Alliance), a nonprofit organization focused on crypto security, documented a significant surge in these attacks throughout March.

According to SEAL, they successfully blocked more than 356 malicious advertising links, characterizing it as “a consistent influx of attacker-deployed Google Ads weekly for over a year.” The organization emphasized that the offensive shows no indication of diminishing and that additional victims continue coming forward with reports.

During the period spanning March 13 to 30 exclusively, cumulative financial losses through these tactics amounted to $1.27 million.

The Threat Extends Beyond a Single Platform

This security challenge transcends any individual platform. During early May, threat actors leveraged Google Ads alongside shared conversations from Anthropic’s Claude AI assistant to execute a malvertising operation specifically designed to compromise Mac users.

Cybersecurity company Malwarebytes additionally identified Facebook as a significant distribution channel for fraudulent advertisements. In February, the firm documented scammers purchasing Facebook ad space to create convincing imitations of official Microsoft promotional materials.

Those unfortunate victims were directed to remarkably accurate duplicates of the Windows 11 download interface, where malicious software engineered to extract cryptocurrency assets and authentication credentials was deployed onto their systems.

This recurring pattern demonstrates that cybercriminals are exploiting major advertising networks to execute persuasive scams targeting both cryptocurrency enthusiasts and mainstream software consumers. Neither Google, Meta, nor other affected platforms have issued comprehensive public responses addressing the magnitude of these fraudulent campaigns.

Scammers have been using Google to deploy malicious phishing advertisements impersonating the crypto protocol Uniswap, which has reportedly netted the attackers at least $400,000. 

The on-chain analyst “b-block” posted to X on Monday that a website impersonating decentralized finance exchange Uniswap was draining funds from multiple wallets and the scammers were holding at least $400,000.

Stacy Muur, founder of Web3 marketing agency Green Dots, said that the scammers had stolen the funds from users through a phishing ad on Google that impersonated Uniswap, and shared a screenshot of a sponsored result from the search engine.

“It’s insane that Google has ignored this issue for years while fake links keep getting pushed above real ones and users keep getting drained,” she said.

Source: Stacy Muur

The two flagged addresses held a combined 146 ETH worth around $306,000, at the time of writing, according to Etherscan.

DeFiLlama said that “fake ads on Google are a common source of phishing attacks.” The crypto non-profit group Security Alliance (SEAL) reported in April that there was a “significant uptick” in phishing activity on Google search in March.

SEAL said that attackers pay Google or hack legitimate advertiser accounts to run convincing fake ads impersonating popular crypto protocols to lure users. Threat actors outbid legitimate crypto exchanges and protocols to achieve a superior position within the “Sponsored results” section on Google Search.

SEAL blocked over 356 malicious advertisement links, a number which is “representative of a steady volume of attacker-deployed Google Ads each week for more than a year,” it added. “The campaign is not slowing down, and we are receiving more reports from affected users.”

Related: ‘TrapDoor’ malware targets crypto dev tools in supply chain attack

The phishing ads used legitimate-looking URLs to bypass Google’s automated checks, while a hidden secondary iframe loads the malicious payload, also invisible to Google’s detection.

Victims land on convincing clones of real crypto apps, with all network traffic secretly routed through attacker-controlled servers, explained SEAL, reporting that $1.27 million in total funds were stolen between March 13 and 30.

In early May, it was reported that attackers were abusing Google Ads and legitimate shared chats from AI chatbot Claude in an active “malvertising” campaign targeting Mac users.

Facebook is also a hotbed of fake ads and scams, according to Malwarebytes, which reported in February that scammers were running paid ads that looked like official Microsoft promotions. 

Victims were directed to near-perfect clones of the Windows 11 download page, where malware designed to steal crypto and credentials was deployed. 

Magazine: Polymarket seeks Japan entry, Harvard dumps entire ETH position: Hodler’s Digest

Decentralized platform Hyperliquid is now competing with established betting platforms such as Polymarket, but with a differentiated mechanism for resolving bets.

The leading decentralized exchange has expanded its HIP-4 outcome contracts beyond crypto price milestones into real-world events. This native prediction-market infrastructure allows users to trade macro contracts, such as inflation data and interest-rate decisions, directly alongside their standard crypto perpetuals out of a single account.

Outcome markets mark a notable expansion for the decentralized derivatives venue, which built its business around crypto perpetual futures and initially tested the product using price‑outcome contracts settled against its own market data.

Hyperliquid first tested the product on exchange‑native outcomes, such as whether bitcoin would trade above a specific level by a fixed time using Hyperliquid’s own reference prices. The latest rollout expands that model into real‑world macro events, or offchain outcomes, like U.S. inflation and Federal Reserve decisions, directly competing with prediction market platforms like Polymarket.

Native resolution

What sets it apart is that HIP‑4 brings dispute resolution and settlement in‑house, rather than depending on an external oracle network like Polymarket.

Here’s why it matters. Offchain events introduce a new problem: determining truth.

Polymarket handles this through UMA, an external oracle protocol that uses an optimistic dispute system. A proposed settlement stands unless challenged, at which point UMA tokenholders vote on the final result. That model has faced criticism following controversial resolutions, prompting accusations that large tokenholders could influence outcomes.

Hyperliquid uses a more vertically integrated model. Validators themselves ingest external information through automated newsfeed software, determine whether markets should launch, and vote on settlement outcomes.

Multi-purpose platform

The launch also fits into Hyperliquid’s broader effort to evolve into a multi‑asset trading venue. FalconX said in a recent report that the exchange’s expanding product stack could position it as a challenger not just to crypto‑native rivals but also to traditional exchanges.

“For example, you could pair a HIP‑3 perps position on NVDA with outcome markets that NVDA will miss or beat earnings,” CoinDesk previously reported.

Hyperliquid’s outcome markets are structured as fully collateralized contracts rather than leveraged bets, thereby limiting losses to the amount paid upfront. Traders buy “Yes” or “No” positions tied to a defined event, with contracts settling at either 1 USDC or zero USDC depending on the result. If a trader buys a “Yes” contract at 0.65 USDC, their maximum loss is limited to that upfront amount, unlike perpetual futures, where leverage can trigger liquidations.

That makes the product sit somewhere between a prediction market and a simplified binary options contract.

If Hyperliquid’s outcome markets gain traction, traders could eventually use the same venue to express directional crypto views, hedge macro risks, and speculate on event outcomes without moving collateral between platforms.

Bitcoin is sliding into a high-risk environment due to continued institutional selling, primarily from US spot exchange-traded funds, according to crypto analytics platform Swissblock.

Swissblock said on Tuesday that its Bitcoin risk index was at a high risk score of 33 out of 100, adding that “every time the Risk Index signals that selling pressure is structurally overwhelming the market, what sits underneath is institutional distribution.”

The platform’s proprietary risk index was developed to gauge the overall risk level in the Bitcoin market by measuring the relative balance between selling pressure and buying pressure, helping to assess how “risky” it currently is to buy or hold Bitcoin.

After strong accumulation in March and April, May has flipped back into distribution, and the risk index is now “moving into high-risk territory while ETF flows are deteriorating simultaneously,” said Swissblock.

It added that spot Bitcoin ETF demand is no longer absorbing selling pressure effectively, and without strong ETF support underneath, “the risk index can continue accelerating higher.”

Bitcoin risk index accelerates with increasing ETF outflows. Source: Swissblock

Related: $1.26B Bitcoin ETF outflows spark ‘contrarian’ buy signal: Santiment

On-chain analytics provider Glassnode reported on Monday that US Bitcoin ETFs have recorded net outflows on nearly every trading day since May 7, showing “a persistent institutional sell signal now running for more than two weeks.”

“This steady drip of outflow continues to add to the supply side without a visible demand offset,” it said. 

Jeff Ko, chief analyst at CoinEx, told Cointelegraph on Tuesday that the broader crypto market “remains in a holding pattern.”

“Spot ETF flows have posted more than $2 billion in outflows over the past two weeks, highlighting that institutional risk appetite is still sensitive at the margin,” he added. 

Bitcoin dips as US strikes Iran

Risk was accelerated even further on Tuesday morning amid multiple reports that the US had launched fresh strikes on Iran despite the two countries recently making progress on a peace deal.

US Central Command said the strikes targeting Iranian missile sites and boats attempting to place mines were in “self-defense” and were to protect US troops from threats posed by Iranian forces.

Bitcoin reacted with a 1% decline, falling from over $77,000 to just below $76,500 on Coinbase, according to TradingView, but it has remained range-bound for almost four months.

Ko said that “despite Washington’s latest ‘self-defence’ operation, the very short-term market reaction may still lean risk-on, particularly as investors appear to be looking through the geopolitical noise and focusing on the possibility of a US-Iran peace deal.”

Magazine: Polymarket seeks Japan entry, Harvard dumps entire ETH position: Hodler’s Digest

Fundamental backdrop

In late April 2026, Japan’s Ministry of Finance moved from verbal warnings to direct action, carrying out a currency intervention worth roughly ¥5.5 trillion ($35 billion) — the first since July 2024. The move was triggered by the yen weakening beyond the psychologically significant level of 160 against the dollar.

Additional context comes from the divergence in monetary policy between the ECB and the Bank of Japan: the European regulator continues to leave the door open to tighter policy amid rising inflation expectations, while Tokyo maintains a cautious normalisation path without providing clear guidance on the timing of its next move.

Technical picture

After reaching a local peak near 188 in mid-April, the EUR/JPY pair experienced two impulsive declines. The first occurred on 30 April, when the candlestick recorded an abnormal spike in vertical volume — a direct consequence of the Japanese Ministry of Finance intervention, which saw the yen strengthen by roughly 3% during the session. A second bout of sharp selling pressure followed in early May.

As a result, a horizontal profile formed with boundaries at 183.800–185.000, while the point of control is concentrated within the 184.50–184.70 range.

The price is now testing the upper boundary of the profile — an area where sellers have already shown activity on two separate occasions. The 182 region has held since February and could once again come into focus if pressure resumes: both May sell-offs reversed precisely from this zone, failing to break lower. Meanwhile, the 185.500 area could act as resistance should the current advance continue.

RSI + MA readings stand at 57 / 55 / 53 respectively — all three lines remain in neutral territory, with no clear signs of momentum.

Key takeaways

The current situation is shaped by the clash between interest-rate differentials and the willingness of the Japanese authorities to intervene again if necessary. For now, with RSI offering no directional impulse, the point of control and the profile boundaries remain the key reference levels for assessing the current trading range.

Trade over 50 forex markets 24 hours a day with FXOpen. Take advantage of low commissions, deep liquidity, and spreads from 0.0 pips (additional fees may apply). Open your FXOpen account now or learn more about trading forex with FXOpen.

This article represents the opinion of the Companies operating under the FXOpen brand only. It is not to be construed as an offer, solicitation, or recommendation with respect to products and services provided by the Companies operating under the FXOpen brand, nor is it to be considered financial advice.

Ether treasury company Bitmine Immersion Technologies has been included in a preliminary list for potential inclusion in the Russell 3000 index, a move that chairman Tom Lee hinted could provide tailwinds for the company’s stock.

FTSE Russell, a subsidiary of the London Stock Exchange Group, published a preliminary index inclusion list for the Russell 3000 on Friday, its index tracking the 3,000 largest companies in the US. 

Lee said in an X post Saturday that Bitmine could be included in the Russell 1000, an index tracking the largest 1,000 US companies, due to the index’s minimum market capitalization threshold of $5.7 billion. Bitmine’s market cap was $10.15 billion as of market close on Friday.

Lee said that “many active managers only buy equities on the Russell 1000,” adding that it is estimated that up to 25% of the market cap of a stock included in the index is held by passive index funds or exchange-traded funds.

Source: Tom Lee

Bitmine’s inclusion in the Russell 1000 would place it in the same index as major US large-cap equities, including tech giants Nvidia Corporation, Microsoft, and Apple and could trigger automatic buying by passive funds, providing traditional investors with indirect exposure to its Ether holdings.

FTSE Russell will provide further list updates on, June 5, June 12 and June 18, and the newly reconstituted indexes take effect after the US market close on June 26.

Bitmine stock down 30% year to date

Shares in Bitmine Immersion Technologies (BMNR) are down over 30% year-to-date and closed trading on Friday at $18.88. The company announced plans to build an Ether treasury in July 2025. By July 3, its stock had spiked to more than $135. The company disclosed holdings of 163,142 Ether worth about $500 million on July 14 of the same year.

Bitmine’s stock is down over 30% year-to-date. Source: Google Finance

As of last week, Bitmine held 5.28 million Ether, or about 4.37% of Ethereum’s total supply, with the company’s ultimate goal to hold 5% of the token’s circulating supply of 120.7 million. To hit its target of over 6 million Ether, Bitmine needs around 756,538 more in its stash.

Related: Ether pullback was ‘attractive opportunity’ for 71,672 ETH buy: Bitmine’s Lee 

Ether is down over 57% from its all-time high of $4,946, according to CoinGecko. BitMine also has an estimated $7.3 billion in paper losses due to the price drop. 

However, Lee previously argued that Ether’s steep drawdown may offer another buying opportunity and said last Monday that the company has staked most of its stash, with annualized staking revenues of $289 million.

Magazine: Polymarket seeks Japan entry, Harvard dumps entire ETH position: Hodler’s Digest, May 17 – 23 

Ondo Finance founder Nathan Allman has died, the company said in a post on X on Tuesday, without disclosing the cause.

“It is with profound sadness that we announce the unexpected passing of Nathan Allman, Ondo’s founder. Our hearts are with his family and loved ones,” the company said. “Nate’s brilliance, humility, and drive shaped every part of what Ondo is today. His belief in the power of technology to create a more open, accessible financial system lives on in everything we build.”

Ian De Bode, Ondo’s longtime president who has led strategy, product, and day-to-day operations for over two years, will serve as CEO. De Bode has the full confidence of the leadership team, the company said.

Allman, a Brown University graduate, founded Ondo in 2021 after working on Goldman Sachs’ digital assets team. Under his leadership, Ondo became a pioneer in tokenized real-world assets, growing total value locked to $3.5 billion.

Major products launched during his tenure include USDY, a yield-bearing stablecoin, OUSG, a tokenized U.S. Treasury fund, and tokenized equities through Ondo Global Markets.

The company said it would continue building what Allman started as the most meaningful way to honor him.

The combined market value of all stablecoins has hit a record high of $322 billion, dwarfing the foreign exchange reserves of 95 countries, including several developed countries.

As of now, their combined market cap is bigger than the FX reserves of Poland, Thailand, Mexico, and developed economies such as the United Kingdom, Canada and even the oil-exporting giant United Arab Emirates.

In essence, the amount of dollars and other fiat currencies held by users outside traditional banking channels now exceeds the official FX reserves, a sovereign protective cover against external economic shocks, of most nations.

Stablecoins are tokenized versions of fiat currencies issued on blockchain. Their values are pegged 1:1 to the U.S. dollar or other currencies such as the euro, yen, Swiss franc and others. Their combined market cap has grown multi-fold in recent years, with most activity concentrated in dollar-pegged coins such as tether USDT$0.9994 and USD Coin (USDC).

The growth is evidence of how fast capital is migrating to blockchain rails.

Foreign exchange (FX) reserves are the dollars, euros, yen, and gold that central banks hold as a buffer to stabilize their currencies, pay foreign debts, and finance energy and other imports. Only 14 nations, led by China, Japan, Russia, India, Taiwan and Germany, hold more FX reserves than the market value of stablecoins.

Double-edged sword

Stablecoins are widely used for trading cryptocurrencies. They allow users to exit volatile tokens without converting back to fiat currencies. For DeFi protocols, they serve as the settlement layer, and for cross-border payments, they provide a faster, cheaper way to move money across borders while bypassing legacy banking channels.

“The use of stablecoins in cross-border payments has grown, notably in corridors where legacy correspondent banking is slow or costly,” a recently released Bank of International Settlements report said. “Cross-border stablecoin flows have grown substantially since 2022, with particularly pronounced activity in regions experiencing high inflation and exchange rate volatility.”

But the ease of moving money comes with a risk.

Stablecoin transactions can trigger capital outflows, leaving already vulnerable current account deficit countries exposed to fiat-currency depreciation.

“Increases in stablecoin flows are associated with subsequent domestic currency depreciation, deviations from covered interest parity and widening wedges between stablecoin-implied and official exchange rates in segmented markets (Aldasoro et al (2026)),” the BIS said.

“These patterns are consistent with stablecoins enabling circumvention of capital controls and providing a relatively frictionless mechanism for EMDE residents to shift savings into dollar-denominated instruments,” the bank added.