{"investigation":{"slug":"fake-ai-crypto-arbitrage-bot-youtube-campaign-2026","entity_name":"Fake AI Crypto Arbitrage Bot YouTube Campaign (2026)","trust_score":0,"severity_base":null,"score_modifier":0,"confidence":0.9,"status":"published","content_type":"investigation","summary":"Between February and August 2026, a coordinated campaign of nine YouTube tutorials falsely claimed to teach viewers how to build AI-powered crypto arbitrage bots using Anthropic's Claude. According to blockchain intelligence firm TRM Labs, the tutorials directed victims to a fake code compiler mimicking the Remix IDE; when victims deployed the supplied contracts and pressed Start or Withdraw, all wallet balances above 0.05 ETH were silently forwarded to attacker-controlled addresses. TRM Labs attributed losses of 274.60 ETH (approximately $517,000) across 224 victims, with all nine videos remaining live and accumulating over 310,000 combined views as of September 2026.","sections":[{"content":"TRM Labs documented a coordinated YouTube scam campaign active from at least February 12 to August 11, 2026. Nine near-identical tutorials, presented as content from separate creators, claimed to teach viewers how to use Anthropic's Claude AI to build a fully automated crypto arbitrage bot. According to TRM Labs, the videos featured AI-generated presenters and synthetic voiceovers to simulate creator diversity, and followed identical scripts including fabricated profit promises — such as a claimed return of 1 ETH every 20 hours — and manufactured testimonials. Supporting written guides were hosted on Telegraph, Amazon S3, and Google Cloud Storage with near-identical instructions across all nine channels. TRM Labs noted the same operation ran an identical playbook in 2025 using ChatGPT branding, indicating the AI name functions as an interchangeable marketing hook rather than a functional component.","heading":"Campaign Overview","sources":[{"url":"https://www.trmlabs.com/resources/blog/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers","name":"TRM Labs: Fake AI Trading Bots Are Getting Victims to Build Their Own Drainers","type":"research","credibility":2},{"url":"https://cryptobriefing.com/trm-labs-fake-ai-bot-tutorial-scam/","name":"Crypto Briefing: Fake Claude trading bot tutorials drain $517K from 224 crypto users","type":"news_article","credibility":2}],"severity":"critical"},{"content":"The scam relied on a fake code compiler website controlled by the attackers, designed to visually mimic the legitimate Remix IDE used by Ethereum developers. Victims were instructed to paste source code into the fake compiler interface; according to TRM Labs, at least one version of the fake compiler discarded the victim's pasted source code entirely and instead fetched and compiled a different contract from the operator's server. The code displayed on screen to the victim was never the code actually deployed on-chain. The deployed contracts contained no arbitrage logic and no AI functionality. Instead, they accepted deposits and automatically forwarded any wallet balance exceeding 0.05 ETH to attacker-controlled addresses whenever the victim pressed the Start or Withdraw buttons shown in the tutorial. TRM Labs confirmed that no Anthropic product was present anywhere in the deployed contracts and that Claude played no role in generating or deploying the malicious code.","heading":"Technical Attack Method","sources":[{"url":"https://www.trmlabs.com/resources/blog/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers","name":"TRM Labs: Fake AI Trading Bots Are Getting Victims to Build Their Own Drainers","type":"research","credibility":2},{"url":"https://cryptobriefing.com/trm-labs-fake-ai-bot-tutorial-scam/","name":"Crypto Briefing: Fake Claude trading bot tutorials drain $517K from 224 crypto users","type":"news_article","credibility":2}],"severity":"critical"},{"content":"TRM Labs traced losses totaling 274.60 ETH (approximately $517,205 USD at the time of transfer) from 224 identified victims, who collectively deployed 234 smart contracts across the campaign period. The median loss per victim was 1 ETH. Stolen funds flowed into six operator-controlled wallet addresses. According to TRM Labs, the funds were subsequently moved entirely through decentralized finance protocols, cross-chain bridges, and a cryptocurrency mixer, with no centralized exchange involvement detected — a routing pattern that significantly complicates attribution and recovery efforts.","heading":"Victim and Financial Impact","sources":[{"url":"https://www.trmlabs.com/resources/blog/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers","name":"TRM Labs: Fake AI Trading Bots Are Getting Victims to Build Their Own Drainers","type":"research","credibility":2},{"url":"https://www.yahoo.com/news/us/articles/fake-ai-crypto-bot-tutorials-124715640.html","name":"Yahoo News: Fake AI Crypto Bot Tutorials Steal $517,000 in ETH From YouTube Users","type":"news_article","credibility":2},{"url":"https://coinspectator.com/cryptonews/2026/09/18/fake-ai-trading-bot-tutorials-steal-274-6-eth-from-224-victims/","name":"CoinSpectator: Fake AI trading bot tutorials steal 274.6 ETH from 224 victims","type":"news_article","credibility":2}],"severity":"critical"},{"content":"The campaign exploited growing public interest in AI-powered trading tools by branding the tutorials around Anthropic's Claude AI assistant. The use of a named, commercially recognized AI product — Claude — provided a veneer of credibility and attracted technically curious investors seeking accessible automation tools. The tutorials walked victims through each step of the deployment process, including wallet setup, code copying, contract deployment, and funding, making victims themselves the authors of every on-chain transaction. This self-deployment mechanic meant victims authorized each action and transferred funds willingly, which complicates victim recovery and may reduce the legal exposure of the operators in some jurisdictions. TRM Labs noted that a prior iteration of the same campaign used OpenAI's ChatGPT branding in 2025, indicating that the AI branding is modular and the underlying infrastructure is reused across campaigns.","heading":"Social Engineering and AI Branding","sources":[{"url":"https://www.trmlabs.com/resources/blog/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers","name":"TRM Labs: Fake AI Trading Bots Are Getting Victims to Build Their Own Drainers","type":"research","credibility":2},{"url":"https://airdropalert.com/blogs/claude-trading-bot-scam/","name":"AirdropAlert: Claude Trading Bot Scam: Fake YouTube Tutorials Drain $517K","type":"news_article","credibility":2}],"severity":"high"},{"content":"As of September 2026, TRM Labs reported that all nine YouTube tutorials remained live and had accumulated 310,474 combined views. No public statement from YouTube confirming takedown of the identified videos had been located as of this writing. The continued availability of the videos on the platform represents an ongoing and active threat to new victims who may encounter the content through YouTube's recommendation algorithm or via search. Viewers who have not yet interacted with the fake compiler website remain at risk. The campaign's self-replicating structure — with independent-appearing channels, cloud-hosted written guides, and a persistent fake compiler — indicates operational infrastructure that could be reactivated or duplicated rapidly even if current videos are removed.","heading":"Ongoing Threat Status","sources":[{"url":"https://www.trmlabs.com/resources/blog/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers","name":"TRM Labs: Fake AI Trading Bots Are Getting Victims to Build Their Own Drainers","type":"research","credibility":2},{"url":"https://panews.io/articles/01a0b719-1a28-735d-8646-e4b0aa567aac","name":"PA News: TRM Labs: Fake AI Trading Bot Tutorials on YouTube Induced Users to Deploy Malicious Scripts","type":"news_article","credibility":2}],"severity":"critical"},{"content":"TRM Labs identified signs of unified production across all nine YouTube channels, including identical scripts, shared infrastructure (the same fake compiler domain or domains), identical profit claims, and fund consolidation into six shared receiving addresses. No individual or group has been publicly named, charged, or arrested in connection with this campaign as of September 2026. TRM Labs did not publicly disclose the attacker wallet addresses, specific YouTube channel URLs, or the domain of the fake compiler in the materials reviewed. The use of DeFi protocols, cross-chain bridges, and a mixer to launder proceeds suggests awareness of blockchain tracing methods and intent to obstruct attribution.","heading":"Attribution and Operator Identity","sources":[{"url":"https://www.trmlabs.com/resources/blog/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers","name":"TRM Labs: Fake AI Trading Bots Are Getting Victims to Build Their Own Drainers","type":"research","credibility":2},{"url":"https://cryptobriefing.com/trm-labs-fake-ai-bot-tutorial-scam/","name":"Crypto Briefing: Fake Claude trading bot tutorials drain $517K from 224 crypto users","type":"news_article","credibility":2}],"severity":"high"},{"content":"Legitimate arbitrage bot code deployed on a public blockchain is transparent and verifiable on-chain. Any tutorial that directs users to a third-party compiler website rather than the official Remix IDE (remix.ethereum.org) or a locally installed development environment should be treated as suspect. Verified indicators of this specific campaign include: tutorials claiming to use Claude or other named AI tools to generate profitable arbitrage contracts; step-by-step instructions to fund a freshly deployed contract immediately after deployment; a third-party compiler site that visually resembles Remix but operates from a different domain; and profit claims in the range of 1 ETH per 20-hour cycle. Users who have deployed contracts following any such tutorial should treat the deploying wallet as compromised and should not transfer additional funds to it.","heading":"Protective Guidance","sources":[{"url":"https://www.trmlabs.com/resources/blog/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers","name":"TRM Labs: Fake AI Trading Bots Are Getting Victims to Build Their Own Drainers","type":"research","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2025-01-01","event":"A prior iteration of the same campaign allegedly ran using ChatGPT branding, according to TRM Labs. Exact dates within 2025 were not specified in available reporting.","source":"TRM Labs research blog","source_url":"https://www.trmlabs.com/resources/blog/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers"},{"date":"2026-02-12","event":"First identified malicious contract deployment in the 2026 Claude-branded campaign, per TRM Labs on-chain analysis.","source":"TRM Labs research blog","source_url":"https://www.trmlabs.com/resources/blog/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers"},{"date":"2026-08-11","event":"Last identified malicious contract deployment in the campaign period analyzed by TRM Labs.","source":"TRM Labs research blog","source_url":"https://www.trmlabs.com/resources/blog/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers"},{"date":"2026-09-18","event":"TRM Labs published findings; reporting by Crypto Briefing, CoinSpectator, PA News, and others confirmed 224 victims, 274.60 ETH stolen, and 310,474 combined YouTube views across nine live tutorials.","source":"Crypto Briefing / CoinSpectator","source_url":"https://cryptobriefing.com/trm-labs-fake-ai-bot-tutorial-scam/"},{"date":"2026-09-22","event":"AirdropAlert published secondary coverage; all nine YouTube videos reported still live.","source":"AirdropAlert","source_url":"https://airdropalert.com/blogs/claude-trading-bot-scam/"}],"sources_used":[{"url":"https://www.trmlabs.com/resources/blog/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers","name":"TRM Labs: Fake AI Trading Bots Are Getting Victims to Build Their Own Drainers","type":"research","archive_url":"http://web.archive.org/web/20260919073617/https://www.trmlabs.com/resources/blog/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers","credibility":2,"archive_timestamp":"2026-09-19T07:36:17+00:00"},{"url":"https://www.yahoo.com/news/us/articles/fake-ai-crypto-bot-tutorials-124715640.html","name":"Yahoo News: Fake AI Crypto Bot Tutorials Steal $517,000 in ETH From YouTube Users","type":"news_article","archive_url":"https://web.archive.org/web/20261009005850/https://www.yahoo.com/news/us/articles/fake-ai-crypto-bot-tutorials-124715640.html","credibility":2,"archive_timestamp":"2026-10-09T00:58:50+00:00"},{"url":"https://coinspectator.com/cryptonews/2026/09/18/fake-ai-trading-bot-tutorials-steal-274-6-eth-from-224-victims/","name":"CoinSpectator: Fake AI trading bot tutorials steal 274.6 ETH from 224 victims","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://panews.io/articles/01a0b719-1a28-735d-8646-e4b0aa567aac","name":"PA News: TRM Labs: Fake AI Trading Bot Tutorials on YouTube Induced Users to Deploy Malicious Scripts","type":"news_article","archive_url":"https://web.archive.org/web/20261009032915/https://panews.io/articles/01a0b719-1a28-735d-8646-e4b0aa567aac","credibility":2,"archive_timestamp":"2026-10-09T03:29:15+00:00"},{"url":"https://cryptobriefing.com/trm-labs-fake-ai-bot-tutorial-scam/","name":"Crypto Briefing: Fake Claude trading bot tutorials drain $517K from 224 crypto users","type":"news_article","archive_url":"http://web.archive.org/web/20260923005156/https://cryptobriefing.com/trm-labs-fake-ai-bot-tutorial-scam/","credibility":2,"archive_timestamp":"2026-09-23T00:51:56+00:00"},{"url":"https://airdropalert.com/blogs/claude-trading-bot-scam/","name":"AirdropAlert: Claude Trading Bot Scam: Fake YouTube Tutorials Drain $517K","type":"news_article","archive_url":"https://web.archive.org/web/20261009032845/https://airdropalert.com/blogs/claude-trading-bot-scam/","credibility":2,"archive_timestamp":"2026-10-09T03:28:45+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-10-08T23:04:03.122642+00:00","updated_at":"2026-10-09T04:12:02.003697+00:00"},"source_quality":{"total":6,"tier1":0,"tier2":1,"tier3":0,"unrated":5},"follower_count":null,"content_updated_at":"2026-10-08T23:04:03.290Z","last_fact_checked_at":null,"fact_check_next_allowed_at":null,"update_next_allowed_at":null}