🕵️ FAKE UNISWAP / ANGELFERNO DRAINER CAMPAIGN — FORENSIC TRACE REPORT

Date of Analysis: May 26, 2026 | Case Ref: CASE-20260526-AFDR

SUMMARY

A live, actively draining phishing campaign is targeting Uniswap users via sponsored Google Ads. The operation deploys the AngelFerno drainer-as-a-service kit — a scam-as-a-service platform previously linked to front-end attacks against OpenEden and Curvance. Two primary collector wallets have aggregated $400,000+ in stolen assets, with the broader campaign responsible for $1.27M+ since March 2026 according to Security Alliance (SEAL).

Attack vector: Victims search "Uniswap" on Google → click sponsored ad → land on a pixel-perfect phishing clone → connect wallet → sign a malicious approval transaction → all tokens/ETH are swept instantly by the drainer contract.

Critical finding: Both drainer wallets remain active as of May 25–26, 2026, with the largest movements occurring within the past 48 hours.

ON-CHAIN TRACE

🔴 Drainer Wallet #1

0x37925684BA178821b4436E06e67f5dBD6cfA49Bb Primary ETH aggregator — most active of the two

Activity window: May 12 – May 25, 2026 (34 traced transactions, 109 total analyzed)

Cross-chain bridge confirmed (Relay protocol):

• TX 0x76bb7ae7360056f16774c58201fc844a4aa75dd1d15dfc28fd96c17e7a00365f (Base) bridges 3.135 ETH → Ethereum main drainer, destination TX 0xad3ee71e425192734ade50a40ca26d2140f66cf33cf9d06ad29167a5ccec79cc

NEAR Intents bridge detected:

• Two NEAR Intents inbound deliveries totaling 2.260 ETH (0x39a85b...ef79 + 0xec85c5...2c8b), suggesting funds were laundered through the NEAR protocol ecosystem before being returned to Ethereum.

🔴 Drainer Wallet #2

0x2fC25F46cC49D226eF92E9A7665f3d2821F3c5E2 High-volume batch collector — 51 inbound transactions in 72 hours

Activity window: May 23 – May 25, 2026 (51 traced transactions — most recent activity: May 25, 2026)

This wallet's transaction profile is highly abnormal: the vast majority of inbound txs originate from 0xca11bde05977b3631167028862be2a173976ca11, which is the canonical Multicall3 contract deployed at the same address across all EVM chains. This is a hallmark of the AngelFerno drainer kit — it batches victim asset sweeps using Multicall3 to maximize throughput per block and reduce per-victim gas costs.

The 30+ additional inbound transactions from 0xca11 across May 24–25 represent a rolling wave of victim drains occurring in near real-time.

🟡 Key Intermediary / Hop Addresses

CURRENT STATUS OF FUNDS (as of May 26, 2026)

Drainer #1 — 0x37925684BA178821b4436E06e67f5dBD6cfA49Bb

Total current portfolio: ~$169,268

⚠️ ACTIVE: ~$6,578 USDC still parked on Base chain + ~$162K ETH value on Ethereum. No CEX deposit detected yet for these funds — the attacker is holding or continuing to launder.

Drainer #2 — 0x2fC25F46cC49D226eF92E9A7665f3d2821F3c5E2

Total current portfolio: ~$228 (Polygon MATIC) + tokens

Finding: Drainer #2 has been nearly fully swept outbound — ETH was consolidated and moved. The Multicall3 batch operations flooding this address represent the actual drain engine; the real ETH value has been passed through and laundered onward. The residual KISHU/ORX tokens are likely to be OTC-sold or simply abandoned.

ANALYSIS & RECOMMENDATIONS

Laundering Architecture — Confirmed Techniques

The AngelFerno campaign employs a 4-layer laundering stack:

Layer 1 — Victim Drain (via Malicious Approval): Victims sign an approve() transaction on the phishing site, granting the drainer contract unlimited allowance. AngelFerno uses the Multicall3 contract (0xca11bde05977b3631167028862be2a173976ca11) to batch-sweep all victim assets in a single block — ETH, ERC-20 stablecoins, LP tokens, and NFTs simultaneously.

Layer 2 — Token Conversion (via DEX aggregators): Stolen tokens (USDC, USDT, PAXG, meme tokens) are routed through 0x Protocol (0x0000000000001ff3684f28c67538d4d072c22734) and Uniswap V2 Router to convert into ETH or USDC — a standard "dirty → clean native" laundering step.

Layer 3 — Cross-Chain Layering (Relay + NEAR Intents): Proceeds are bridged across chains to break the on-chain trace:

• Relay.link bridge confirmed (Base ↔ Ethereum): TX 0x76bb7ae7360056f16774c58201fc844a4aa75dd1d15dfc28fd96c17e7a00365f
• NEAR Intents bridge: 2.26 ETH routed through NEAR ecosystem and returned to Ethereum
• Stargate Finance USDT bridge: 5,098 USDT bridged outbound (May 12)

Layer 4 — Consolidation & Off-ramp (Pending): No confirmed CEX deposit detected yet. Current holding pattern (~$169K on Drainer #1) suggests the operator is either waiting for Google to remove the ads and then bulk cashing out, or has a private OTC arrangement. The token dump address 0x02e5be68d46dac0b524905bff209cf47ee6db2a9 receives illiquid tokens and is the likely OTC/DEX liquidation point.

Phishing Infrastructure Patterns (OSINT-confirmed)

Risk Score

Recommended Actions

Immediate (0–24 hours):

1. Relay.link cooperation request — Relay bridge confirmed funds movement between Base and Ethereum. Contact Relay.link security team with TX 0x76bb7ae...365f and 0xad3ee71...79cc to identify any linked KYC data or IP logs.
2. NEAR Intents / NEAR Foundation cooperation — Two NEAR Intents bridge deliveries totaling 2.26 ETH. The NEAR-side source address may be traceable and may be linked to a NEAR-registered entity.
3. Google Ads abuse report escalation — File formal abuse reports with Google's Trust & Safety team citing both drainer wallet addresses, the Multicall3 drain pattern, and SEAL's documented campaign tracking. Uniswap Labs and ZachXBT have already applied public pressure; a formal legal hold request from law enforcement would be more effective.
4. Victim alert distribution — Broadcast both drainer addresses (0x37925684BA178821b4436E06e67f5dBD6cfA49Bb and 0x2fC25F46cC49D226eF92E9A7665f3d2821F3c5E2) and the hop wallet (0xe245f57734ef7f2a868cc549ca1003e658781b3a) to all major CEXs for pre-emptive freeze requests. If the operator attempts to cash out via Binance, Coinbase, Kraken, OKX, or Bybit, these flags will trigger compliance review.
5. Revoke emergency advisory — Victims who interacted with any Uniswap-lookalike site in the past 30 days should immediately check and revoke all token approvals via revoke.cash or [filtered].io/tokenapprovalchecker.

Follow-up (24–72 hours):

1. Trace 0x02e5be68d46dac0b524905bff209cf47ee6db2a9 — This token dump aggregator receives all illiquid stolen tokens (PAXG, Mog, XEN, PERP, NMT, SPCX). It may interact with a known OTC desk or NFT marketplace that has KYC.
2. Trace 0xe245f57734ef7f2a868cc549ca1003e658781b3a — The 3.845 ETH hop from Drainer #1 is parked here with minimal outbound activity. This wallet may be staged for a future CEX deposit. Monitor urgently.
3. SEAL coordination — Security Alliance is actively tracking this campaign (356+ malicious ads blocked). Share this trace with SEAL radar at radar.securityalliance.org.
4. Base chain follow-up — Drainer #1 holds 6,577 USDC and 0.26 WETH deposited into Aave (aBasWETH) on Base. This Aave position may be unwound in coming days; monitor the Base chain activity of 0x37925684BA178821b4436E06e67f5dBD6cfA49Bb closely.

Fund Recovery Feasibility: MODERATE-LOW. The ~$169K currently held by Drainer #1 has not yet been deposited to a regulated CEX — this is the window for a freeze request. However, if the operator off-ramps via OTC or DEX, recovery becomes effectively impossible. Time is critical.