Fake AI Bot Tutorials Tricked 224 Victims Into Building Their Own Crypto Drainers
Fake tutorials lead to self-inflicted crypto drain
Fake YouTube tutorials promising AI-built crypto arbitrage bots tricked 224 victims into deploying and funding their own malicious smart contracts, draining 274.60 ETH between Feb. 12 and Aug. 11, according to a September 14 analysis by blockchain intelligence firm TRM Labs.
TRM Labs found 234 victim-deployed contracts feeding six operator-controlled collection addresses. The stolen ETH was valued at about $517,205 at the time of the transfers, with a median loss of 1 ETH per victim.
How the scam worked
Unlike typical crypto drainer campaigns, the attackers did not rely on victims signing malicious token approvals or visiting fake websites. Instead, each victim chose a tutorial, copied code, deployed a contract, and funded it from their own wallet. This made the transactions appear self-directed, which could bypass wallet security systems.
TRM identified nine nearly identical YouTube tutorials presented as the work of separate creators. They promised an arbitrage bot built with Claude, an AI assistant, and directed viewers to compiler sites controlled by the operators. Some of these sites were designed to look like the widely used Remix development environment.
In one variant analyzed by TRM, a background script replaced the victim's pasted code with a different contract fetched from the operator's server. The clean code shown on screen never reached the blockchain.
The substituted contract accepted deposits and forwarded any balance above 0.05 ETH to the operator when the victim pressed Start or Withdraw—the same actions the tutorial instructed them to take. TRM said the contracts contained no arbitrage logic or AI functionality; Claude was used only as a lure.
Additional attempted theft
One compiler site tried to extract a second payment after the initial drain by displaying a fake “gas nonce liquidity” error and telling the victim to add another 50% of the original deposit, up to 1 ETH. TRM said the term is not an Ethereum concept and the message was designed to prompt another transfer.
Scope and persistence
The nine videos remained online as of September and had accumulated 310,474 views, according to TRM. The firm also identified earlier versions of the scheme from 2025 that used ChatGPT as the lure, showing that operators can change the AI branding without changing the underlying theft method.
What is confirmed
TRM Labs, a blockchain intelligence firm, reported 224 victims, 234 victim-deployed contracts, six operator addresses, and a total loss of 274.60 ETH (about $517,205 at the time) between Feb. 12 and Aug. 11. The median loss was 1 ETH. Nine YouTube tutorials remained online as of September and had 310,474 views. The scheme used fake compiler sites to swap in malicious contracts.
What is still unclear
The article does not specify the identities of the operators, the full list of tutorial channels, or the exact date when TRM Labs published its analysis (only that it was September 14). It also does not confirm whether any legal action has been taken.
Why this matters for crypto users
This attack shows that even cautious users can lose funds by following seemingly helpful tutorials. The transactions looked self-directed, so wallet security tools may not flag them. It highlights the risk of copying and deploying code from unverified sources, even when the code appears to come from a trusted platform like YouTube.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.
Related Posts
