Scammers attacked Aave users via Google Ads

07.08.2025

Miroslava Andreeva Scammers have launched a phishing campaign targeting Aave users through Google Ads. This is reported by cybersecurity experts from PeckShield.

The attackers placed paid ads in Google Ads that mimicked the official Aave platform. When victims clicked on the links, they were redirected to fake websites where they were asked to connect their crypto wallets. After that, the scammers gained access to their funds.

Such transactions are irreversible. The exact amount of damage is still unknown. Users should carefully check the URLs of websites. In case of wallet compromise, it is urgent to transfer funds to a secure address, contact the provider through official channels, and revoke permissions through services like Revoke.cash.

On the eve of reports of a phishing attack, Aave became the first DeFi protocol whose total net deposits across 14 networks exceeded $60 billion.

According to Token Terminal, the figure has more than tripled over the year. In August 2024, it was $18 billion.

Fraudulent Campaign on YouTube

At the same time, experts from SentinelLABS reported on another attack on crypto investors. According to them, starting in 2024, attackers are seizing old YouTube channels that published news about cryptocurrencies.

Fraudsters promote trading bots that steal users' funds. Videos are created using AI, and negative comments are promptly deleted.

Victims are offered to deploy a smart contract that hides the addresses of cybercriminals. After replenishment, the money is sent to the scammers' wallets.

What does the instruction for replenishing a fraudulent smart contract look like? Source: SentinelLABS According to specialists, users are asked to deposit a minimum of 0.5 ETH (~$1829 at the current exchange rate) to cover fees. One fraudulent address has already received about 244.9 ETH, and two others — 7.59 and 4.19 ETH. In total, this already exceeds $939,000.

"We have recorded the use of the same wallet in several malicious smart contracts. However, multiple unique addresses are involved, so it is impossible to determine the exact number of fraudsters," emphasized SentinelLABS.

Recall that on August 6, a crypto investor lost $3 million by signing a malicious transaction. As part of the phishing attack, a common practice was used: the attackers create fake addresses or links that mimic the ordinary.