Fake AI Trading Bot Tutorials Steal 274.6 ETH from 224 Victims

Blockchain intelligence firm TRM Labs reported that a series of YouTube tutorials claiming to teach users how to build AI‑driven arbitrage bots actually led victims to deploy malicious Ethereum contracts. The operation affected 224 individuals, who collectively lost 274.6 ETH (approximately $517,000 at the time of the theft).

How the Scam Worked

Each tutorial instructed viewers to copy code and compile it on a website that resembled the popular Remix IDE. Although users saw legitimate‑looking source code, the backend of the compiler replaced it with a different contract controlled by the scammers. Victims then deployed the contract themselves and funded it, believing it would run an arbitrage strategy powered by Anthropic’s Claude AI model.

Malicious Contract Behavior

• The deployed contract accepted ETH deposits.
• When a deposit exceeded 0.05 ETH, the contract automatically transferred the balance to one of six collection addresses owned by the operators.
• Both the “Start” and “Withdraw” functions performed the same transfer, giving the appearance of normal bot controls while actually draining funds.

Scale of the Attack

TRM Labs traced 234 contracts deployed through the scheme, with some victims creating multiple contracts. The median loss per victim was 1 ETH, indicating that the total theft was not driven by a single large victim. Funds were funneled to six distinct addresses controlled by the scammers.

Why Traditional Defenses Failed

Unlike typical phishing attacks that rely on malicious links or requests for broad token approvals, this campaign made each victim the contract creator. Because the contracts were newly generated, they did not appear on existing blacklists, and users authorized all transactions themselves, bypassing common wallet warnings.

Reporting and Prevention

U.S. victims can report such losses to the FBI’s Internet Crime Complaint Center, which shares information with law‑enforcement agencies. Ongoing efforts by security alliances—including MetaMask, Phantom, WalletConnect, and Backpack—aim to improve detection of wallet‑drainer tactics that exploit legitimate user actions.