Gnosis co-founder Martin Köppelmann said a sponsored Google search result for "gnosis safe" led users to a polished phishing clone of the Safe wallet website. According to his post on X, the ad appeared as Safe.global in search results but redirected users to the spoofed domain wallet-safe.global after being clicked. He said the fake site copied the interface of Safe, the multisig wallet that manages more than $60 billion in assets.
Köppelmann said the risk begins once a user connects a wallet and signs a transaction or message. At that point, the phishing site can submit an approval request designed to drain funds from the account. He also criticized Google, saying the company often suspends ads from legitimate crypto projects while continuing to sell premium ad placement to scammers.
The report noted that this was not an isolated case. In August this year, a fake Trezor wallet ad also appeared at the top of Google search results, and the related address received about 24 BTC. The security advice cited in the report was straightforward: avoid clicking results marked as sponsored, bookmark official websites, and verify domain names carefully before connecting a wallet.
Gnosis co-founder Martin Köppelmann said in a post on X that the top result for a Google search of "gnosis safe" was a paid advertisement leading to a polished phishing clone of the Safe wallet website.
He said the fake site copied the interface of Safe, the multisig wallet that manages more than $60 billion in assets.
Köppelmann criticized Google, saying the company often suspends ads from legitimate crypto projects while still selling top ad placements to scammers.
A screenshot he shared showed the ad displayed as Safe.global, but clicking it redirected users to the spoofed domain wallet-safe.global. Once a user connected a wallet and signed, the site could submit an approval request intended to drain the account.
This type of Google ad scam has appeared before. In August this year, a fake Trezor wallet ad also showed up at the top of search results, and the related address received about 24 BTC.
The security advice cited in the report included avoiding results marked as "Sponsored," bookmarking official URLs, and checking domain names carefully.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
