Fraudulent Google Ad Targeted Safe Multisig Wallets
A phishing advertisement mimicking the Safe platform was identified in top Google search results.
Updated on Oct. 12, 2026 in Financial Crime
Live Poll
Do you trust search engines to screen out fraudulent advertisements in their sponsored results?
Security researcher Martin Köppelmann flagged a deceptive Google ad that directed users to a malicious clone domain. The fake site, titled wallet-safe.global, impersonated the legitimate Safe multisig wallet platform to solicit wallet connections.
Why it matters
The incident highlights the ongoing risk of financial loss through sponsored search results that mimic official cryptocurrency platforms. These phishing campaigns can lead to the immediate drainage of digital assets when users sign unauthorized requests.
Official data confirms the Safe platform currently secures over $60 billion in assets. Authorities are still investigating the full scope of the recent phishing attempt.
The players
Martin Köppelmann
He is a researcher who identified the fraudulent advertisement targeting the Safe platform.
Safe
This is a platform for multisig wallets that holds over $60 billion in user assets.
The details
Scammers used a paid Google advertisement to steer traffic toward the fraudulent domain wallet-safe.global. Visitors to the site are prompted to connect their wallets and sign requests, which subsequently allows the attackers to drain account funds.
Timeline
The Safe project completed its brand transition from Gnosis Safe in 2022.
A fraudulent Uniswap website compromised approximately $400,000 in May 2026.
Theft of 24 BTC occurred following a fake Trezor advertisement in August 2026.
Martin Köppelmann identified the current Safe advertisement scam on October 12, 2026.
Legal Context
This incident follows a pattern set by the August 2026 fraudulent Trezor advertisement. Such phishing campaigns mirror rising threats where scammers exploit search engine advertising to intercept users.
Users should exercise extreme caution when clicking sponsored search results to access cryptocurrency platforms. Always verify the domain name matches the official site to prevent unauthorized access to digital wallets.
The takeaway
Always navigate directly to official platforms by typing the URL rather than relying on search engine advertisements. Enabling hardware security measures and scrutinizing every signature request can help protect assets from sophisticated phishing attempts.
Further reading
Learn more about ongoing security threats in the Financial Crime section.
Source note: This article includes information reported by BeInCrypto.
Live Poll
Do you trust search engines to screen out fraudulent advertisements in their sponsored results?
