According to CoinMeta, as monitored by security company Salus, a user clicked on a Google sponsored ad and was directed to a counterfeit Hyperliquid website, resulting in a loss of 550,000 USDC. This case utilized a coin-stealing service infrastructure associated with the Inferno system; the phishing gang was responsible for purchasing ads, setting up fake entry points, and providing payment addresses. After the coin theft was successful, the backend automatically completed the division of the funds.