Fake AI Trading Bot Tutorials Drained 274.6 ETH From 224 Victims Who Deployed the Malicious Contracts Themselves

Fake YouTube tutorials promising viewers a free AI-powered crypto arbitrage bot have drained 274.6 ETH, worth roughly 517,000 USD at the time of the transfers, from 224 victims who unknowingly deployed the malicious contracts themselves, according to blockchain intelligence firm TRM Labs.

The September 14 report describes a scam that abandons the classic phishing playbook entirely. There are no copied domains, no poisoned search results and no suspicious wallet approval pop-ups. Instead, victims are talked through building their own drainer, step by step, in a scheme that turns the mark into the attacker’s deployment tool.

How the fake AI bot tutorials worked

TRM identified nine nearly identical YouTube tutorials published under different creator identities, each presented by AI-generated virtual hosts with synthetic voiceovers. The videos promised to teach viewers how to build a fully automated crypto arbitrage bot using Anthropic’s Claude, presenting the process as an educational exercise rather than an investment opportunity.

Viewers were told to copy source code displayed in the video and open a compiler website chosen by the presenter. Several of these sites copied the design of Remix, the widely used browser-based development environment for writing and deploying Ethereum smart contracts. Victims then connected their wallets, compiled what looked like legitimate trading software and deployed the resulting contracts to the blockchain.

Because users initiated and approved every action themselves, the transaction flow looked nothing like a conventional attack. Wallets accurately showed their owners deploying a contract, funding it and later calling one of its functions. The missing context was that the tutorial and the compiler had quietly swapped out the code.

The bait-and-switch hidden in the compiler

In one documented variant, a backend script ignored the source code victims pasted into the compiler window. Instead, the website retrieved a separate contract from a server controlled by the operators and prepared that replacement for deployment. The clean code displayed on screen was never placed onchain.

The replacement contract behaved exactly as a trading bot should in its early life: it accepted ETH deposits, matching user expectations that the bot needed capital to exploit price differences between venues. But once the contract balance exceeded 0.05 ETH, the code was set to forward the funds to an operator-controlled address whenever the user pressed either the Start or the Withdraw button.

Both buttons served the same purpose despite carrying the labels of ordinary bot controls. Pressing Start did not activate any trading strategy. Pressing Withdraw did not return the deposit. TRM’s analysis found no arbitrage system and no AI function in the malicious variant it examined. The Claude branding was pure sales pitch, while the onchain code did nothing but collect deposits and sweep qualifying balances.

234 contracts, six collection addresses, one median loss of 1 ETH

TRM traced 234 contracts deployed through the campaign, against 224 affected people, meaning some participants created more than one contract before realizing what had happened. Stolen funds eventually funneled into six collection addresses controlled by the operators.

The distribution of losses is notable for what it lacks: a single whale victim propping up the total. TRM calculated a median loss of 1 ETH per incident, indicating the damage was spread across a broad base of ordinary users, many of whom likely funded the contracts with modest amounts expecting passive arbitrage returns.

Why wallet protections missed the attack

Traditional crypto phishing defenses rely on pattern recognition. Blocklists flag known malicious addresses, domain checks catch lookalike sites and transaction simulations warn users when a signature grants broad token allowances or control over existing assets.

This operation slipped past those layers because each victim deployed a freshly created contract from their own wallet. A new address has no history to match against a blocklist. A wallet simulation can show that a user is deploying a contract and sending ETH to it, but without the context that the tutorial and compiler misrepresented the code, the activity resembles ordinary development work.

The social engineering happened offchain, in the video and on the fake compiler site, while every onchain action was technically initiated by the victim. That structure is what makes the campaign distinct from wallet-drainer attacks that spread through malicious links and blanket approvals, and it suggests a growing overlap between AI-generated content fraud and smart contract crime.

AI branding as the trust mechanism

The campaign also reflects how attackers are weaponizing the credibility of mainstream AI tools. By framing the scam around Claude and automated arbitrage, the operators tapped into current enthusiasm for AI agents in crypto trading, a narrative that legitimate projects have spent the past year promoting.

AI-generated hosts and voiceovers gave each tutorial the appearance of an independent guide while allowing the same script to be republished across multiple channels at low cost. TRM’s count of nine near-identical videos under different identities suggests an industrialized content pipeline rather than a one-off effort.

What users can take from it

The lesson from the TRM findings is uncomfortable: verifying what you see on screen is no longer enough when the deployment pipeline itself is compromised. Users who paste code into a third-party compiler are trusting that platform to compile exactly what is shown, and in this scheme that trust was the exploit.

Practical defenses include compiling code only through official or verified channels, treating any tutorial that requires funding a self-deployed contract with deep skepticism, and remembering that legitimate arbitrage opportunities rarely require retail users to build their own bots from a YouTube video. As AI tools make polished fraudulent content cheaper to produce, the burden of verification keeps shifting toward the user, and campaigns like this one show exactly how that gap gets exploited.