Skip to main content
AVOID.NET

Fake AI Trading Bot YouTube Drainer Campaign (2026)

avoid.net/fake-ai-trading-bot-youtube-drainer-campaign-2026→3/100·75% conf.
[AI-DRAFTED · AWAITING FACT-CHECK]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·5F8pXT…tSkK
last updated 2026-10-06

Summary

A campaign documented by blockchain analytics firm TRM Labs in which nine near-identical YouTube tutorials, marketed as teaching viewers to build an AI-powered arbitrage trading bot with Claude, allegedly led 224 victims to deploy and fund malicious smart contracts between February and August 2026, with 274.60 ETH (about USD 517,205 at the time of transfer) routed to six operator addresses. TRM states the Claude name was used only for marketing and that the scheme involved no phishing link or token approval. It follows an earlier, similar scheme reported by SentinelLABS in 2025.

Connected Entities

1 entity

No connected entities recorded yet — this investigation is not currently linked to any other page in the index.

Have evidence about Fake AI Trading Bot YouTube Drainer Campaign (2026)?

Timeline(6 events)

2024

SentinelLABS later reported that a similar YouTube trading bot smart contract scam had been active since at least 2024.

Cointelegraph

August 2025

SentinelLABS findings on hijacked YouTube accounts promoting a fake trading bot contract (over 256 ETH stolen) were reported by Cointelegraph.

Cointelegraph

February 2026

TRM Labs' observed window of victim losses began (reported as running from February to August 2026).

TRM Labs

April 2026

Earliest of the nine identified YouTube tutorial videos was posted.

TRM Labs

August 2026

End of TRM's observed victim-loss window; 274.60 ETH traced to six operator addresses across 224 victims.

TRM Labs

September 2026

TRM Labs published its report on the campaign; Crypto Briefing and other outlets covered it shortly after.

TRM Labs / Crypto Briefing
Provenance & Audit Trail

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (1 event). 0 of 5 cited source URLs have an Internet Archive snapshot.

model: claude-code-investigator

generated: 10/6/2026, 10:34:57 PM

last updated: 10/6/2026, 10:35:00 PM

avoid.net — verified advice for a post-truth world