Hackers stole an estimated $50M+ over 3 years by buying Google Search ads, sending users to fake domains that looked like popular Bitcoin wallet Blockchain.info
Context & Ripple Effects
Blockchain.info has been a repeat target: in 2015, hackers ran rogue Tor exit relays to intercept its users' traffic and steal Bitcoin. The new reporting shows the same victim reached through a different chokepoint — instead of hijacking network infrastructure, attackers simply bought Google Search ads so that users hunting for the wallet landed on lookalike domains.
First-order effects
- Users who searched Google for Blockchain.info and clicked the sponsored result were sent to convincing fake domains, losing an estimated $50M+ in Bitcoin over three years — with the losses hitting individual wallet holders directly rather than any exchange.
Second-order effects
- Wallet providers like Blockchain.info are pushed into brand-defense work — monitoring ad auctions and domain registrations for impersonations — while Google faces pressure to vet which advertisers can bid on branded crypto terms; the channel stayed open long enough that by late 2023 researchers at ScamSniffer found Google and X ads still promoting crypto drainers that had taken $59M from tens of thousands of victims.
Third-order effects
- Repeated large-scale thefts — from this ad campaign to the 20+ nine-figure-capable exchange and project hacks of 2021 — harden a structural split in crypto between self-custody users who must verify every URL themselves and platforms forced to treat brand impersonation as a permanent security line item, with ad platforms under growing scrutiny as the distribution layer for scams.
The trend: Crypto theft is migrating from technical exploits toward paid-distribution attacks — search and social ads impersonating trusted brands — making the ad platforms themselves a recurring attack surface.