Fake YouTube tutorials promising AI-built crypto arbitrage bots led 224 victims to deploy and fund their own malicious smart contracts, draining 274.60 ETH between Feb. 12 and Aug. 11, TRM Labs said in a Sept. 14 analysis.
The blockchain intelligence firm said it found 234 victim-deployed contracts feeding six operator-controlled collection addresses. It valued the stolen ETH at about $517,205 at the time of the transfers and put the median loss at 1 ETH.
Discover more
Machine Learning & Artificial Intelligence
FINANCE
Engineering & Technology
Unlike conventional drainer campaigns, the operation did not rely on a victim signing a malicious token approval or visiting a spoofed domain. Each victim chose a tutorial, copied code, deployed a contract and funded it from their own wallet, making the transactions appear self-directed to wallet security systems.
A Fake Compiler Swaps the Contract
TRM identified nine nearly identical YouTube tutorials presented as the work of separate creators. They promised viewers an arbitrage bot built with Claude and directed them to compiler sites controlled by the operators, some styled to resemble the widely used Remix development environment.
In one variant analyzed by TRM, a background script discarded the source code pasted by the victim and fetched a different contract from the operators server. The clean code shown on screen never reached the blockchain.
The substituted contract accepted deposits and forwarded any balance above 0.05 ETH to the operator when the victim pressed Start or Withdraw — the same actions the tutorial instructed them to take. TRM said the contracts contained no arbitrage logic or AI functionality; Claude was used only to market the scheme.
One compiler site tried to extract a second payment after the initial drain by displaying an invented “gas nonce liquidity” error and telling the victim to add another 50% of the original deposit, up to 1 ETH. TRM said the term is not an Ethereum concept and the message was designed to prompt another transfer.
The nine videos remained online as of September and had accumulated 310,474 views, according to TRM. The firm also identified earlier versions of the scheme that used ChatGPT as the lure in 2025, showing how operators could change the AI branding without changing the underlying theft mechanism.