Fake YouTube tutorials that claimed to show viewers how to build AI-powered crypto arbitrage bots tricked 224 victims into deploying and funding malicious smart contracts of their own, according to a Sept. 14 analysis from TRM Labs. The firm said the operation drained 274.60 ETH between Feb. 12 and Aug. 11.
TRM said it identified 234 contracts deployed by victims that funneled funds to six collection addresses controlled by the operators. It valued the stolen ETH at about $517,205 at the time of the transfers and said the median loss was 1 ETH.
Victims carried out the key steps themselves
TRM said the campaign differed from conventional drainer operations. It did not depend on a victim signing a malicious token approval, and it did not require a visit to a spoofed domain. Instead, each victim picked a tutorial, copied code, deployed a contract, and funded it from a personal wallet. That made the transactions appear self-directed to wallet security systems.
A fake compiler replaced the contract code
TRM identified nine nearly identical YouTube tutorials presented as if they came from separate creators. The videos promised an arbitrage bot built with Claude and directed viewers to compiler websites controlled by the operators. Some of those sites were styled to resemble the widely used Remix development environment.
In one version reviewed by TRM, a background script discarded the source code pasted by the victim and fetched a different contract from the operator’s server. The clean code shown on screen never made it onto the blockchain.
The substituted contract accepted deposits and forwarded any balance above 0.05 ETH to the operator when the victim clicked Start or Withdraw, the same actions described in the tutorial. TRM said the contracts contained no arbitrage logic and no AI functionality. Claude, it said, was used only as marketing for the scam.
One site tried to collect a second payment
TRM said one compiler site attempted to extract another transfer after the initial drain. It displayed an invented “gas nonce liquidity” error and instructed the victim to add another 50% of the original deposit, up to 1 ETH. TRM said the term is not an Ethereum concept and that the message was designed to prompt another payment.
Nine videos were still online in September
According to TRM, the nine videos remained online as of September and had accumulated 310,474 views. The firm also identified earlier versions of the same scheme that used ChatGPT as the lure in 2025, showing that the operators could swap the AI branding while keeping the theft mechanism unchanged.