Article
【Fake AI trading bot tutorials trick 224 victims into deploying malicious contracts】
Blockchain intelligence firm TRM Labs disclosed in a report published on September 14 that fake YouTube tutorials lured victims with the promise of building crypto arbitrage bots using AI, persuading 224 victims to deploy and fund malicious smart contracts themselves, resulting in the theft of 274.6 ETH TRM identified 234 contracts deployed by victims, with the funds ultimately flowing into 6 operator-controlled receiving addresses; the stolen ETH was worth approximately 517000 USD at the time of transfer, with a median loss per transaction of 1 ETH. Unlike common wallet-draining attacks, this scam did not involve phishing links, spoofed domains, or malicious authorization prompts. Victims independently selected the tutorials, copied the code, deployed the contracts, and funded them from their own wallets; each step was authorized by the victims themselves, so wallet security warnings and phishing blacklists were unable to trigger. TRM found 9 nearly identical YouTube tutorials posing as different creators. The videos used AI-generated virtual presenters and voiceovers, promised to build fully automated crypto trading bots with Claude, and directed victims to compiler websites controlled by the operators, some of which imitated the commonly used Remix development environment. In one variant analyzed by TRM, a backend script discarded the source code pasted by victims and retrieved another contract from the operator's server; the clean code displayed on screen was never put on-chain. The substituted contract accepted deposits and, when victims pressed Start or Withdraw, transferred balances exceeding 0.05 ETH to the operators; the contract contained no arbitrage logic or AI functionality.