Top Google Ads Are Scamming Crypto Wallet Users. Here's How to Avoid Them

Martin Köppelmann, co-founder of Gnosis, says searching “gnosis safe” on Google returns a sponsored ad as the very first result, and that advertisement is a scam. Clicking it takes users to a carefully made replica of Safe, the multisig wallet that holds more than $60 billion.

Self-custody wallets were designed to remove intermediaries. Even so, a lot of people still locate their wallet via a search engine that sells its prime position to the highest bidder.

How a Google Ad Scam Manages to Fool Safe Users

Köppelmann was part of the Gnosis team that originally built Safe before the project was spun off into its own company. He drew attention to the advertisement on X.

I hate this so much. The top Google result (an ad) leads to a well-made scam version of @safe. Given how often legitimate crypto projects get suspended from ad programs, fkn @Google still happily sells its top spot to scammers after all these years. pic.twitter.com/VzwM5zn25v

— koeppelmann (@koeppelmann) October 11, 2026

The advertisement carries the label Safe.global and shows google.com as its display link, yet the actual destination behind the ad is wallet-safe.global, a lookalike domain.

The fraudulent page is nearly an exact copy of the legitimate Safe Wallet app, all the way down to the current product banner featured on the real site.

What stands out is that the ad catches people who are still using the search term “gnosis safe”, even though Safe abandoned that name in a 2022 rebrand.

After a visitor connects a wallet and signs, a drainer page can request approvals that empty the wallet. So a single careless click is all the fake page needs.

Köppelmann’s view is that Google frequently removes genuine crypto businesses from its ad platforms, yet the search giant continues to sell the position at the very top to scammers.

Why the Top Sponsored Link Is the Most Dangerous One

This is not the first time a Google ad has been used to target crypto users. In August, a counterfeit Trezor page appeared as the first sponsored result for searches of “Trezor wallet”, and the Bitcoin address linked to it took in roughly 24 BTC.

An on-chain investigator said a phony Uniswap website drained close to $400,000 from several wallets back in May.

DeFiLlama, in a similar incident, allowed a fraudulent App Store version of its app to drain an actual wallet, a move intended to prod Apple into removing the bogus listing.

A handful of straightforward habits can head off these traps.

• When looking for a wallet, exchange or DeFi app, ignore any search result tagged “Sponsored”, since those paid ads are pinned to the very top of the page, above the organic results.
• Bookmark the official site URL once and from then on only use that bookmark.
• Read the domain character by character before connecting; fraudsters often swap in lookalike letters, such as a lowercase “l” for an uppercase “I”, to deceive people.
• Verify links by checking the project’s official X feed or documentation.
• Treat any unexpected request to sign or approve tokens as a warning sign.

For now, the responsibility for checking every link remains with the individual user. Until advertising networks make their screening stricter, saving the official address in your bookmarks is still the simplest protection against the next Google ad scam.