A Hyperliquid user lost about $550,000 in USDC after clicking a malicious Google search advertisement that redirected them to a fake version of the exchange. FlashRescue co-founder Darcy flagged the case on Aug. 13, and blockchain records showed roughly 550,019 USDC moved from the victim's wallet to three addresses identified as 0x98b2761559A348968C994D9856dCfc96B6f13C55, 0x93b6B24DC6E6a1D5d72399e3A35498c4DbA1d6D1 and 0x6fE314fD4CF845f35fc461eD98e2FB8d9356B566, in transfers of about 440,015 USDC, 82,503 USDC and 27,501 USDC. GoPlus Security separately flagged two of the same addresses, and Google suspended the advertiser account behind the campaign. The incident fits a broader pattern of malicious sponsored-search attacks aimed at decentralized finance users. Security Alliance, or SEAL, documented more than 356 malicious advertising URLs over several weeks in April, including 17 websites impersonating Hyperliquid. The group said attackers often use hacked or illicitly purchased verified advertiser accounts, submit a clean landing page on a trusted domain for review, and then use cloaking or nested iframes so potential victims see a fake trading interface while researchers or automated scanners are shown benign content such as Wikipedia. SEAL found evidence of drainer malware linked to the Inferno Drainer and Vanilla Drainer families in similar campaigns, though no public evidence has tied a specific drainer to this Hyperliquid case. SEAL estimated about $1.27 million in confirmed and suspected losses tied to malicious Google advertising between March 13 and March 30 alone and advised users to rely on bookmarks or search.defillama.com instead of Google Search for crypto apps. There is no indication Hyperliquid's blockchain infrastructure or smart contracts were breached. The attack appears to have intercepted the user before they reached the legitimate platform, matching Hyperliquid's own warning to verify full website URLs. The case also follows similar phishing warnings from Trezor earlier in August and a separate July incident in which Scam Sniffer said a user lost $999,999 in USDT on Ethereum. Hyperliquid has become a larger target as its activity has grown, with HyperTracker showing a record 263,666 active perpetual contract traders on Aug. 6, up from roughly 150,000 in early January 2026, while the HYPE token returned 79.2% in the latest quarter and reached an all-time high of $76.90 on June 16. As of Aug. 14, no law enforcement investigation or asset recovery tied to this loss had been publicly announced.