What happened
On July 11, 2022, attackers impersonated Uniswap in a phishing campaign that targeted Uniswap V3 liquidity providers on Ethereum. CertiK reports that a fake UniswapLP.com token was airdropped to roughly 74,000 wallets; victims who approved the associated claim transaction exposed their liquidity-position NFTs, allowing the attacker to take 3,278 ETH and 240 WBTC, then convert the WBTC and send about 7,500 ETH to Tornado Cash. This was not a vulnerability in the Uniswap protocol.
How it happened
- The attacker created and airdropped a fake UniswapLP.com token that directed recipients to a rewards-claim site.
- The site persuaded victims to approve a SetApprovalForAll transaction.
- That approval let the attacker take victims' Uniswap V3 position NFTs.
- The attacker redeemed the positions for ETH and WBTC, swapped the WBTC to ETH, and routed approximately 7,500 ETH to Tornado Cash.
Protocol details
Classification
Exchange (DEX) / Social Engineering
Protocol Type
Exploit/Phishing
Affected asset / contract
UNI
Evidence
- report Report en.cryptonomist.ch
- report Report theblock.co
- report Report cointelegraph.com
- report Report decrypt.co
- report Report beincrypto.com
- analysis Web Archive web.archive.org
- analysis DeFiLlama defillama.com
- analysis Uniswap Phishing Incident Analysis certik.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
