Fake AI Crypto Bot Tutorials Steal $517K in ETH

Scammers used fake YouTube tutorials about AI-powered crypto trading bots to trick hundreds of users into building and funding their own wallet drainers, according to blockchain intelligence firm TRM Labs.

The campaign stole 274.6 Ether, worth approximately $517,000 at the time of transfer, from at least 224 wallets between February and August 2026. The median victim lost 1 ETH, while the stolen funds ultimately flowed through six addresses believed to be controlled by the operators.

Unlike traditional crypto scams, the scheme did not rely on unsolicited phishing links or suspicious token approvals. Victims found the tutorials, copied the supplied code, deployed smart contracts, and authorized every transaction themselves.

The supposed trading bots contained no artificial intelligence or arbitrage functionality. Instead, they were designed to transfer deposited ETH directly to the scammers.

New Trending Crypto Wallet Offers

Fake Tutorials Promised Automated Crypto Profits

TRM Labs identified nine nearly identical YouTube tutorials presented as content from separate creators. The videos promised to show viewers how to create fully automated crypto arbitrage bots using Anthropic’s Claude AI assistant.

The tutorials featured AI-generated presenters and voiceovers, alongside detailed screen recordings that walked viewers through setting up a wallet, copying source code, deploying a contract, and supplying it with trading capital.

Several videos used virtually identical scripts and displayed the same purported profits, including claims that users could earn 1 ETH every 20 hours. Fabricated comments and testimonials reinforced the impression that the bots worked.

Fake AI trading-bot tutorials on YouTube walk victims into deploying their own drainers. TRM traced 274.60 ETH from 224 victims.

Read the analysis here ➡️ https://t.co/M0GljMO7Ok pic.twitter.com/kC1q9GNGbE

— TRM Labs (@trmlabs) September 18, 2026

The nine videos had accumulated more than 310,000 views since the earliest appeared in April. TRM also found older versions of the scam that had already been removed from YouTube.

Claude did not play any role in the deployed contracts. TRM found no model queries, API keys, or other AI functionality. The scammers were simply exploiting growing interest in AI coding tools to make an unrealistic trading system appear accessible to inexperienced users.

Similar campaigns detected in 2025 used ChatGPT’s name instead, suggesting operators can change the AI branding without substantially altering the scam.

Fake Compiler Secretly Replaced the Code

Most steps demonstrated in the tutorials appeared legitimate. The crucial compromise occurred when viewers were instructed to use a compiler website selected by the video’s creator.

Some of these websites imitated Remix, a widely used development environment for Ethereum smart contracts. Although the sites displayed apparently harmless source code, they did not necessarily compile the user-pasted code.

Scammers found a way to make people drain their own wallets without sending them a phishing link.

They uploaded YouTube tutorials showing people how to build an AI crypto trading bot with Claude.

People followed the tutorial themselves.

Copied the code.

Deployed the smart…

— wyck 📴 (@wyckoffweb) September 20, 2026

In one version analyzed by TRM, a background script discarded the visible source code and downloaded a different contract from a server controlled by the scammers. The clean code shown on the screen never reached the blockchain.

Instead, victims deployed a malicious contract that accepted deposits but contained no trading logic, decentralized exchange integrations, or arbitrage functions. When a victim pressed “Start” or “Withdraw,” any balance above 0.05 ETH was transferred to the operators.

This substitution made the transaction appear legitimate because the victim deployed the contract from their own wallet.

Some victims were then targeted a second time. After their funds disappeared, the fake compiler displayed an error claiming the arbitrage bot needed an additional 50% deposit to resolve a “gas nonce liquidity” problem.

TRM said gas nonce liquidity is not an Ethereum concept. The message existed solely to persuade victims to send more ETH.

Scam Bypassed Conventional Wallet Warnings

The attack was particularly effective because it avoided many signals used by crypto-security products.

Victims did not connect their wallets to an obvious phishing page or approve an unknown third party to spend their tokens. They funded contracts they had deployed and signed transactions they believed were required to operate the bot.

TRM Labs vừa báo cáo một chiến dịch lừa đảo trên YouTube khiến 224 nạn nhân mất tổng cộng 274,6 ETH, trị giá khoảng 517.000 USD tại thời điểm bị chuyển đi.

Điểm đáng chú ý là nạn nhân không bị dụ qua link giả hay website phishing. Họ tự sao chép code từ… pic.twitter.com/8rBdJuLPcj

— J A X (@HieuTrinhVn) September 19, 2026

Consequently, phishing blocklists, wallet alerts, and approval-analysis tools had little suspicious activity to detect. The malicious component appeared at the compiler level, where one set of code was displayed, and different bytecode was deployed.

TRM traced 234 victim-deployed contracts to 224 funding wallets. The earliest identified theft occurred on Feb. 12, while the latest took place on Aug. 11.

The operators subsequently moved the funds entirely through decentralized infrastructure.

Some ETH was exchanged for DAI via decentralized finance protocols and swap services, while other assets were moved across blockchain bridges. At least one route passed through a crypto mixer, and TRM found no centralized exchange in the outbound flow.

How Users Can Avoid Malicious Trading Bots

TRM advised users to treat the development environment as a critical security decision and avoid compilers supplied through tutorials, comments or unofficial guides.

Developers should use independently verified tools and confirm that deployed bytecode corresponds to the source code they inspected.

A professional presenter, a recognizable AI brand, or an active comment section does not prove that a tutorial is legitimate.

The campaign demonstrates how scammers can turn users’ willingness to follow instructions into an attack vector.

Rather than stealing wallet credentials, the operators persuaded victims to construct, fund, and activate the theft mechanism themselves.

Fake AI Crypto Bot Tutorials Steal $517,000 in ETH From YouTube Users

Fake Tutorials Promised Automated Crypto Profits

Fake Compiler Secretly Replaced the Code

Scam Bypassed Conventional Wallet Warnings

How Users Can Avoid Malicious Trading Bots

Related