Martin Köppelmann, co-founder of Gnosis, flagged a paid Google ad this week that appears at the top of search results for 'gnosis safe' and routes users to a scam clone of the Safe multisig wallet. The ad is labeled 'Safe.global' with a display link reading google.com, but clicking it redirects to wallet-safe.global. The fake page copies the real Safe Wallet app closely enough to include its latest product banner, and it's built to drain a user's account once they connect and sign a malicious approval.
Why 'gnosis safe' still gets searched
The ad targets people looking for the wallet under its old name. Safe dropped the 'Gnosis' prefix in a 2022 rebrand, but plenty of users still search the legacy term — and scammers know it. Safe now holds more than $60 billion in assets, which makes its user base a large and lucrative target for this kind of fake-ad play.
Köppelmann didn't just flag the ad. He criticized Google for what he called a double standard: the company often suspends legitimate crypto projects from its advertising programs while still selling top placement to scammers impersonating those same projects. The fake Safe ad ran as a sponsored result, meaning Google was paid for the placement that led users toward the drainer.
This keeps happening on Google
The Safe ad isn't an isolated slip. In August, a fake Trezor page ran as the top sponsored Google result for 'Trezor wallet'; the address tied to it received roughly 24 BTC. In May, a fake Uniswap site drained roughly $400,000 from multiple wallets, according to an on-chain investigator. More recently, DeFiLlama let a fake App Store clone drain a real wallet — a move the platform apparently used to push Apple into removing the scam listing.
The pattern is consistent: buy the top slot on a high-intent search, clone the official interface, and wait for a signature. Sponsored results sit above organic links, so users who trust the top position never see the real domain.
What Safe users should actually do
There's no patch or protocol fix for this one. The defense is behavioral, and the advice is blunt. Skip sponsored results entirely. Bookmark official addresses instead of searching for them. Check domains letter by letter — wallet-safe.global is not safe.global, and the difference is the whole attack. Cross-check links against official X accounts or documentation before clicking. And treat any unexpected signature or token approval request as a red flag, even if the page looks exactly like the app you use.
The broader problem for Google is that its ad review process keeps letting impersonation through in a category where a single click can cost a user everything. Safe users searching under the old Gnosis name are the specific group exposed right now, and that search term isn't going away — the rebrand was four years ago, but muscle memory is longer.
Köppelmann's post puts the issue in front of Google directly. Whether the company pulls the wallet-safe.global ad and tightens review for crypto-related sponsored listings is the open question. Until then, the only reliable filter is the user's own.
