Cryptocurrency users were warned on October 11 after a sponsored Google search result impersonating Safe, the widely used multisignature wallet, directed visitors to a fraudulent website designed to resemble the legitimate platform. The campaign raised concerns about how attackers can use paid search advertisements to reach investors managing substantial digital assets.
The suspicious advertisement redirected users searching for Safe to wallet-safe.global, a lookalike domain registered on October 8, just three days before the warning became public. The legitimate wallet operates through safe.global and app.safe.global.
Gnosis co-founder Martin Köppelmann amplified the warning on Sunday, describing a convincing imitation appearing in Google’s sponsored search results. The incident involved website impersonation rather than a confirmed breach of Safe’s smart contracts or official infrastructure.
No financial losses had been independently established in connection with the advertisement when the initial reports emerged. Nevertheless, the discovery highlighted a significant vulnerability in how cryptocurrency holders find and access financial applications.
Fake Safe Wallet Appeared in Sponsored Google Search Results
The earliest identified public warning came from X user @atshelchin at 03:47 UTC on October 11. The user reported that searching for Safe produced a sponsored result linking to wallet-safe.global instead of the legitimate platform.
The fraudulent website reportedly reproduced the appearance of Safe’s wallet interface, making it difficult to distinguish from the genuine application through visual inspection alone. Other users subsequently reported seeing similar advertisements when searching for related terms, including Gnosis Safe.
At 08:02 UTC, Martin Köppelmann, co-founder of Gnosis, brought wider attention to the campaign through his X account. His warning focused on the placement of the advertisement near the top of Google’s results and the convincing design of the counterfeit interface.
Curve Finance founder Michael Egorov also highlighted the danger later that morning, warning cryptocurrency users about malicious advertisements appearing in search results.
An investigation published by CryptoVank found that the fraudulent domain had been registered on October 8 at 23:29 UTC through OwnRegistrar, Inc., according to public domain registration records.
The short interval between registration and discovery suggested that the website was newly established. However, the registration date alone does not establish when the advertisement first appeared or how many users visited it.
The identities of the people operating the website were not publicly established. There was also no confirmed figure for affected users, wallet approvals or cryptocurrency losses associated with this particular campaign.
Why Safe Wallet Users Are Attractive Phishing Targets
Safe differs from conventional cryptocurrency wallets because its smart contracts allow transactions to require approval from multiple authorized signers.
A typical multisignature arrangement might require two of three authorized owners to approve a transaction before assets can move. This structure reduces reliance on a single private key and is widely used by decentralized autonomous organizations, cryptocurrency investment funds and blockchain businesses managing treasury reserves.
Safe’s own security materials describe its use by major decentralized finance organizations, including Aave, Lido and Morpho.
These characteristics make the platform an attractive impersonation target. Successfully deceiving an individual managing a small wallet might yield limited proceeds, while compromising the approval process used by a large treasury could potentially expose substantially greater amounts.
Importantly, visiting a fake interface or connecting a signer wallet does not automatically give an attacker control over an entire multisignature account.
The actual danger depends on what the malicious website persuades users to authorize. Attackers could attempt to obtain approvals for unauthorized transfers, misrepresent transaction destinations or trick signers into accepting changes to wallet configuration.
Some attacks can also involve malicious contract interactions that alter account permissions or execution rules. Whether any of these mechanisms were implemented on wallet-safe.global had not been independently established.
The distinction between connecting a wallet and granting financial authority is explained in Dave Finances’ guide on how to identify cryptocurrency scams before connecting a wallet, including the risks associated with token approvals and deceptive transaction requests.
Google’s Advertising Rules Prohibit Brand Impersonation
The campaign also raises questions about the screening of cryptocurrency-related advertisements on major search platforms.
Google prohibits advertisers from impersonating legitimate businesses or creating misleading impressions about their identity and commercial relationships.
Under its Misrepresentation advertising policy, Google treats certain deceptive business practices as serious violations that can result in immediate account suspension.
Yet the Safe incident illustrates how a fraudulent advertisement can potentially reach users before the problem is identified and addressed.
Search advertising also creates a particular credibility problem. Sponsored results frequently appear above ordinary search listings, making them prominent entry points for users who are trying to reach a familiar financial service.
The visible advertising label identifies paid placement, but it does not establish that the advertiser is connected to the company being searched for.
There was no independently verified public confirmation of Google’s enforcement response to this specific advertisement at the time of the initial reporting.
The warning followed another cryptocurrency phishing incident involving the Coldcard X account posting a phishing link. Although the delivery mechanism differed, both incidents demonstrated how attackers can exploit sources that cryptocurrency holders may consider trustworthy.
Crypto Security Risks Are Shifting Beyond Blockchain Code
What makes the Safe advertisement particularly concerning is that attackers did not need to find a vulnerability in the wallet’s underlying smart contracts to create a potentially dangerous situation.
Instead, they targeted the route users take to reach those contracts.
This distinction matters because the cryptocurrency industry has invested heavily in code audits, multisignature approvals and private-key security. Those protections remain valuable, but they cannot automatically establish whether the website presenting a transaction is legitimate.
A counterfeit interface can display familiar branding, genuine blockchain balances and apparently normal transaction information while asking the user to approve something entirely different from the intended action.
The risk becomes greater when several individuals participate in the same treasury approval workflow. If multiple authorized signers rely on information presented through the same compromised interface, the protection provided by a multisignature threshold could be weakened.
That does not mean multisignature security is ineffective. It means independent verification by each signer matters just as much as the number of required signatures.
Sponsored Search Results Create an Uneven Security Burden
There is also an uncomfortable imbalance between attackers and users.
An attacker needs a convincing website and sufficient advertising exposure to attract potential victims. A legitimate user, meanwhile, must recognize the incorrect domain, inspect the wallet request and understand the financial consequences before signing.
That places substantial responsibility on individuals performing routine activities.
The economics can be especially attractive to attackers targeting institutional wallets. Even a campaign that reaches relatively few users could prove lucrative if one successful deception exposes a large treasury. However, there is no evidence that this particular advertisement generated such a loss.
For wallet operators, the issue extends beyond providing a secure smart contract. Protecting the brand’s online identity, monitoring counterfeit domains and responding quickly to fraudulent advertisements are becoming important parts of maintaining customer trust.
The broader cryptocurrency security landscape illustrates how different attack methods can undermine investor confidence. In a separate incident, Ledger confirmed unauthorized hardware inside an affected wallet, demonstrating that even devices designed for secure self-custody can face threats outside their core cryptographic protections.
The Safe advertisement targeted an entirely different layer: the interface through which users initiate financial actions.
What the Safe Phishing Warning Means for Investors
For investors, the immediate priority is distinguishing the authentic platform from websites attempting to impersonate it.
Safe’s legitimate application operates at app.safe.global. Accessing the platform through a previously verified bookmark reduces dependence on search advertisements, although users should still verify transaction details and account permissions.
Anyone who interacted with the suspicious website should distinguish between merely opening the page, connecting a wallet and authorizing a transaction. These actions carry different levels of risk.
If suspicious approvals or transactions were signed, users should review the relevant blockchain activity and seek appropriate assistance in assessing whether permissions need to be revoked or assets secured.
For organizations managing multisignature treasuries, independent signer verification and clear transaction review procedures are particularly important.
The October 11 incident has not been linked to a verified financial loss or compromise of Safe’s underlying infrastructure. Its significance lies instead in showing how attackers can position fraudulent interfaces directly in front of users looking for legitimate security tools.
As cryptocurrency custody becomes more sophisticated, the next major weakness may not be a broken cryptographic system. It may be an apparently ordinary website that convinces authorized users to approve something they never intended.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574