Gnosis co-founder Martin Köppelmann says the top Google result for “gnosis safe” is a paid Google ad scam. The sponsored link sends users to a polished clone of Safe, a multisig wallet holding over $60 billion.
Self-custody wallets exist to cut out middlemen. Yet many users still find their wallet through a search engine that auctions its top slot.
How Does a Google Ad Scam Fool Safe Users?
Köppelmann helped build Gnosis, the team that created Safe before spinning it out. He flagged the ad on X.
Screenshots in his post show the ad labeled Safe.global, with a display link reading google.com. However, a click lands on wallet-safe.global, a lookalike domain.
The fake page copies the real Safe Wallet app almost exactly, down to its latest product banner.
Notably, the ad catches users still searching for “gnosis safe,” the name Safe dropped in a 2022 rebrand.
Once a visitor connects and signs, a drainer site can request approvals that empty the account. For that reason, the clone needs only one careless click.
In his view, Google often suspends legitimate crypto projects from its ad programs. Still, the company keeps selling its top placement to scammers, he argued.
Why the First Sponsored Result Is the Riskiest Click
This Google ad scam is far from the first. In August, a fake Trezor page ran as the top sponsored Google result for “Trezor wallet.” The address tied to it received roughly 24 BTC.
In May, a fake Uniswap site drained roughly $400,000 from multiple wallets, according to an on-chain investigator.
Similarly, DeFiLlama recently let a fake App Store clone drain a real wallet. The team did so to push Apple into removing the scam listing.
A few simple habits help users avoid these traps.
- Skip any result labeled “Sponsored” when searching for a wallet, exchange, or DeFi app. Google places these paid ads at the very top, above the regular results.
- Bookmark the official address once and use only that bookmark afterward.
- Check the domain letter by letter before connecting. Scammers often use lookalike letters, such as a lowercase “l” instead of an uppercase “I”, to deceive victims.
- Cross-check links through the project’s official X account or documentation.
- Treat any unexpected signature or token approval request as a red flag.
Meanwhile, the burden of checking every URL still sits with the user. Until ad platforms tighten vetting, a bookmarked official address remains the simplest defense against the next Google ad scam.
