550,000 USDC Lost to a Fake Google Ad: Inside the Inferno Drainer Phishing Campaign Targeting Hyperliquid Users

On approximately August 13, 2026, a Hyperliquid user lost 550,019 USDC after clicking a paid Google advertisement that directed them to a counterfeit Hyperliquid website. The victim connected their wallet and signed a malicious approval transaction. The Inferno Drainer backend — a drainer-as-a-service operation — automatically executed three successive transfers of 440,015 USDC, 82,503 USDC, and 27,501 USDC to attacker-controlled addresses, then split the proceeds automatically: 80% to one address, 15% to a second, and 5% to a third. The incident was publicly reported on August 24, 2026, when security firm Salus published its attribution analysis.

Hyperliquid's protocol was not compromised. No smart contract vulnerability was exploited. No funds held by Hyperliquid or other users were at risk. This was a wallet-drainer phishing theft: the attacker did not break into the protocol — they deceived one user into handing over access to their own wallet. The distinction matters because the risk it represents is not a protocol risk. It is a user-facing risk that every Web3 participant carries regardless of which protocol they use.

Salus linked the phishing infrastructure to the broader Inferno Drainer ecosystem and attributed approximately $52.74 million in aggregate historical losses to connected infrastructure — including the September 2025 UXLINK incident ($43 million) and other prior cases. The operation was advertised on Telegram under the handle @AngelFernoOwner, openly soliciting phishing groups willing to run the front-end operation in exchange for a share of the proceeds.

The attack combined three components that operate independently and can be reassembled against any DeFi protocol's user base: a paid search advertisement that positioned the fake site above the legitimate one in Google results; a convincing clone of the Hyperliquid interface that prompted wallet connection; and the Inferno Drainer backend that handled everything after the victim signed.

Component 1: The Google Ad vector

Google's paid search results appear above organic results and display a domain name chosen by the advertiser. A phishing group purchased a sponsored listing for search terms associated with Hyperliquid, directing users to a domain visually indistinguishable from the legitimate one in a search results page. Users who habitually navigate to DeFi applications through search rather than bookmarked URLs are routinely exposed to this vector — and at $550,000 per incident, paid search phishing is a high-return investment for the operators.

Component 2: The counterfeit interface and wallet approval

The fake site cloned Hyperliquid's interface and prompted the victim to connect their wallet — a standard interaction that most DeFi users perform without suspicion, since legitimate applications require it. After connection, the site presented a transaction for signing. The transaction was not a deposit, swap, or other legitimate operation. It was an ERC-20 approve()call — or an equivalent permit() or setApprovalForAll() signature — granting an attacker-controlled contract unlimited transfer authority over the victim's USDC.

// What the victim's wallet displayed for signing:
// (presented by the fake site as a routine platform interaction)

USDC.approve(
    spender: 0x9bcd...9104a,   // attacker's drainer contract
    amount:  type(uint256).max // unlimited allowance
)

// After the victim signed:
// The drainer contract called transferFrom() without further interaction.
// The victim's wallet was not accessed again — approval was sufficient.

drainer.execute(victim, [
    USDC.transferFrom(victim, 0x98b276…13C55, 440_015e6),  // 80% address
    USDC.transferFrom(victim, 0x93b6B2…1d6D1,  82_503e6),  // 15% address
    USDC.transferFrom(victim, 0x6fE314…B566,    27_501e6),  //  5% address
]);
// Total transferred: 550,019 USDC — no further user interaction required.

Component 3: Inferno Drainer — drainer-as-a-service infrastructure

The phishing group did not build the theft infrastructure themselves. They rented it. Inferno Drainer is a drainer-as-a-service (DaaS) platform that provides subscribing phishing groups with a complete operational stack, advertised openly on Telegram. According to Salus's analysis, the service supplied:

• Malicious approval scripts and administrative panels
• One-time-use drainer contract deployment
• Automated approval-command generation for target tokens
• Automated asset draining after victim signs
• Cross-chain withdrawal routing and token swaps
• Fund consolidation across addresses
• Automated revenue sharing — proceeds split and distributed to pre-configured addresses without manual intervention

The phishing group's role was limited to the front-end: purchasing the Google advertisement, deploying the cloned interface, and supplying a recipient address. Everything from the moment the victim signed — the transfer execution, the revenue split, the consolidation — was handled by the DaaS backend. The operational separation means the drainer infrastructure remains active and available to other phishing groups regardless of what happens to any individual campaign.

Wallet drainer phishing operates on predictable patterns. Every step of this attack had a point at which the user could have identified the threat and stopped. The controls below are ordered by where in the attack chain they intervene.

• Never navigate to DeFi applications through search results. Paid search advertisements are indistinguishable from legitimate results on a results page, and any phishing group can purchase them. Bookmark every DeFi application you use and navigate exclusively from bookmarks. If you must search, scroll past the “Sponsored” label and use only organic results — and still verify the domain before connecting a wallet.
• Verify the domain in the browser address bar before connecting. Phishing sites use domains that are visually similar to the legitimate one — hyphens, substituted characters, additional words, different TLDs. Check the exact domain character by character before any wallet interaction. Legitimate DeFi applications do not change their domains. If the domain is unfamiliar, close the tab.
• Read every transaction before signing it. A wallet connection requires only a signature — no on-chain transaction. Any interaction that prompts a transaction for signing immediately after connection deserves close inspection. Specifically: if the transaction calls approve(), permit(), setApprovalForAll(), or any function that grants a third-party address the ability to transfer your tokens — stop. Legitimate platforms do not require unlimited token approvals as a connection step. An unexpected approval request is a near-certain indicator of a drainer.
• Use a wallet with transaction simulation and risk warnings. Modern wallets including MetaMask, Rabby, and others offer transaction simulation that previews the state changes a transaction will produce before you sign. A malicious approval shows up clearly in simulation: it grants a contract unlimited allowance over your tokens, with no corresponding benefit to you. Enable simulation if your wallet supports it and treat any simulation output showing token allowances you did not expect as a red flag.
• Audit and revoke outstanding token approvals regularly. Tools such as Revoke.cash and Etherscan's token approval checker display all active ERC-20 allowances for your address. Any approval granted to an address you do not recognise as a legitimate protocol contract should be revoked immediately. Regular approval hygiene limits the damage from any approval you may have granted inadvertently.
• Use a hardware wallet for high-value accounts. Hardware wallets display transaction data on a trusted physical screen and require physical confirmation. A phishing site cannot override what a hardware wallet displays. For wallets holding meaningful amounts, the physical confirmation requirement is a meaningful friction point against signing transactions without reading them.