Verify a decision

{"actor":"system:backfill","investigation_id":"9dcd732c-dddb-41ba-947e-6a2586055b3f","kind":"publish","page_slug":"ai-crypto-arbitrage-robot-youtube-scam-network","published_at":"2026-10-12T12:32:14.377Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"AI Crypto Arbitrage Robot YouTube Scam Network","sections":[{"content":"Across multiple reported campaigns, the pattern is consistent: a YouTube video presents what it calls an AI-built or MEV (maximal extractable value) arbitrage trading bot that supposedly generates risk-free profit. Viewers are instructed to open the Remix Solidity IDE (or a lookalike site controlled by the scammer), paste in provided smart contract code, deploy it, and fund it with ETH, typically 1-2 ETH per the tutorials. According to TRM Labs, in the most recent variant observed in 2026, victims used an operator-built compiler site styled to look like Remix; the site discarded the code pasted by the victim and silently compiled a different, attacker-authored contract instead. That contract forwards any balance above a small threshold to the operator once the victim calls a function with an innocuous name like \"Start\" or \"Withdraw.\" Because the victim's own wallet signs and sends every transaction, standard wallet security warnings, phishing blocklists, and malicious-approval detectors do not trigger. SentinelLABS, reporting on an earlier 2024-2025 wave, similarly found contracts that used XOR obfuscation and large decimal-to-hexadecimal conversions to hide the destination address from anyone who tried to read the code before deploying it. TRM also described a follow-up social-engineering step: after the drain, victims see a scripted error message asking them to deposit up to 1 additional ETH to \"unstick\" the bot, which triggers a second transfer to the attacker.","heading":"Core scam mechanism","severity":"critical","sources":[{"credibility":2,"name":"TRM Labs: Fake AI Trading Bots Are Getting Victims to Build Their Own Drainers","type":"research","url":"https://www.trmlabs.com/resources/blog/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers"},{"credibility":2,"name":"CryptoSlate: Fake Ethereum trading bots on YouTube help scammers steal over $900K","type":"news_article","url":"https://cryptoslate.com/fake-ethereum-trading-bots-on-youtube-help-scammers-steal-over-900k/"},{"credibility":3,"name":"Gridinsoft: OneinchSlippageBot Scam: YouTube AI Trading Bot Ads Explained","type":"research","url":"https://blog.gridinsoft.com/youtube-ads-ai-trading-scams/"}]},{"content":"Operators have marketed the bots using whichever AI brand is currently prominent. TRM Labs found a 2026 wave of videos marketed as a \"Claude-built\" arbitrage bot, while an earlier 2025 wave used the ChatGPT name as the lure; TRM states it found no actual Anthropic product, API usage, or AI functionality in the contracts or compiler sites it examined — the AI branding was used only as a marketing hook. SentinelLABS reported that many of the tutorial videos themselves used AI-generated synthetic voices and faces with noticeably robotic tone and stiff movement, apparently to cut production costs and allow scaled output of many near-identical videos. Notably, SentinelLABS and CryptoSlate both reported that the single most lucrative video they traced, tied to roughly $900,000 in losses, appeared to feature a real human presenter rather than an AI avatar, suggesting human-presented content may convert better despite the lower-cost AI alternative being more common across the wider video set.","heading":"Use of AI branding and synthetic media","severity":"high","sources":[{"credibility":2,"name":"TRM Labs: Fake AI Trading Bots Are Getting Victims to Build Their Own Drainers","type":"research","url":"https://www.trmlabs.com/resources/blog/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers"},{"credibility":2,"name":"CryptoSlate: Fake Ethereum trading bots on YouTube help scammers steal over $900K","type":"news_article","url":"https://cryptoslate.com/fake-ethereum-trading-bots-on-youtube-help-scammers-steal-over-900k/"}]},{"content":"A peer-reviewed measurement study by researchers including Kai Li, Shixuan Guan, and Darren Lee, published on arXiv and later in ACM POMACS, built a detection system (\"CryptoScamHunter\") that crawled YouTube and identified 10,442 arbitrage-bot scam videos, posted by roughly 6,600 distinct YouTube accounts, out of more than 25,000 crypto-related videos collected between June 2022 and June 2023. The researchers traced 1,697 scam wallet addresses (354 found directly in bot contracts, with a further 1,343 identified via contract-similarity matching across more than 800 malicious contracts with available source code) and identified an estimated 25,933 distinct victim addresses on Ethereum mainnet and Binance Smart Chain. Their estimate of cumulative losses across the dataset ranged from approximately $7.13 million to $15 million. This figure covers a single one-year measurement window from an independent academic study and is substantially larger than the losses attributed to any single campaign reported since; it indicates the arbitrage-bot scam format was already operating at scale years before the AI-branded variants emerged.","heading":"Scale: academic measurement, 2022-2023","severity":"critical","sources":[{"credibility":2,"name":"Towards Understanding and Characterizing the Arbitrage Bot Scam In the Wild (arXiv preprint)","type":"research","url":"https://arxiv.org/html/2310.12306v1"}]},{"content":"Cybersecurity firm SentinelLABS published research, covered by CryptoSlate, CoinDesk-aggregating outlets, and Web3 Is Going Great around August 7, 2025, describing a campaign in which AI-generated YouTube tutorials promoted free MEV/arbitrage bots. Victims were told to deploy a contract via the Remix Solidity Compiler and call a \"Start()\" function; the contract instead sent funds to a hidden attacker-controlled wallet. SentinelLABS reported the largest single identified attacker address had collected 244.9 ETH, equivalent to roughly $902,000 at the time, from victims who deployed contracts shown in a video with more than 387,000 views; secondary coverage characterized total campaign losses as \"over $1 million.\" SentinelLABS stated the scam pattern had been active since early 2024 and continued to evolve through new videos and freshly created or purchased YouTube accounts. The firm said it was unclear whether a single group or multiple independent threat actors were operating the campaign, since different scam contracts sent funds to different, apparently unrelated wallet addresses.","heading":"2025 SentinelLABS campaign: over $900,000-$1 million reported drained","severity":"critical","sources":[{"credibility":2,"name":"CryptoSlate: Fake Ethereum trading bots on YouTube help scammers steal over $900K","type":"news_article","url":"https://cryptoslate.com/fake-ethereum-trading-bots-on-youtube-help-scammers-steal-over-900k/"},{"credibility":2,"name":"Web3 Is Going Great: Traders lose $1 million to malicious 'trading bot' software","type":"news_article","url":"https://web3isgoinggreat.com/single/mev-bot-scam"},{"credibility":2,"name":"Radom: Sophisticated Trading Bots Execute AI-Fueled Scam on YouTube, Defrauding Crypto Investors of $1 Million","type":"news_article","url":"https://www.radom.com/insights/sophisticated-trading-bots-execute-ai-fueled-scam-on-youtube-defrauding-crypto-investors-of-1-million"}]},{"content":"TRM Labs reported a distinct but mechanically similar 2026 campaign in which nine near-identical YouTube tutorials, which TRM says had accumulated 310,474 views as of September 2026, advertised a fake \"Claude-built\" arbitrage bot. TRM traced 234 victim-deployed contracts to 224 distinct victim wallets, and found 274.60 ETH (approximately $517,205 at time of transfer) had been drained into six attacker-controlled collection addresses between February 12, 2026 and August 11, 2026. The median individual victim loss was approximately 1 ETH, consistent with the startup capital the tutorials recommended. TRM reported that laundering of the proceeds ran through decentralized-exchange swaps into DAI, cross-chain bridges, and a mixing service, with no centralized exchange identified in the outbound flow it traced. The earliest of the nine traced videos was posted in April 2026. TRM found no evidence that Anthropic's Claude or any other AI product was actually used in the contracts or the fake compiler site; the AI branding served only as a marketing device.","heading":"2026 TRM Labs campaign: fake 'Claude-built' bot, approximately $517,000 reported drained","severity":"critical","sources":[{"credibility":2,"name":"TRM Labs: Fake AI Trading Bots Are Getting Victims to Build Their Own Drainers","type":"research","url":"https://www.trmlabs.com/resources/blog/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers"}]},{"content":"Multiple reports describe scammers purchasing or hijacking aged YouTube accounts and filling them with unrelated or recycled content to make the channel appear established and legitimate before posting the scam tutorial. Gridinsoft's analysis of a related variant, marketed under names such as \"OneinchSlippageBot,\" describes the same pattern of YouTube ads promising automated arbitrage or guaranteed daily profit, directing viewers to copy Solidity code into Remix and fund a contract. Gridinsoft is a security-software vendor, and its write-up is the vendor's own analysis rather than independently corroborated research, so claims specific to that report should be treated with lower confidence than the TRM Labs, SentinelLABS, and academic findings above. Separately, researchers have documented a related but mechanically distinct YouTube scam format — hijacked, high-subscriber channels renamed to impersonate public figures (e.g., Elon Musk, Michael Saylor) and used to run fake cryptocurrency giveaway livestreams with deepfaked video or audio. Bitdefender documented more than 1,300 such videos linked to over 150 phishing domains that it attributed to a likely common kit. This giveaway/livestream format relies on direct transfers to a scam address rather than tricking victims into deploying a draining smart contract, and is treated here as a related but separate scam family rather than part of the arbitrage-bot network specifically.","heading":"Distribution methods and account tactics","severity":"medium","sources":[{"credibility":3,"name":"Gridinsoft: OneinchSlippageBot Scam: YouTube AI Trading Bot Ads Explained","type":"research","url":"https://blog.gridinsoft.com/youtube-ads-ai-trading-scams/"},{"credibility":2,"name":"Bitdefender: A Deep Dive into Stream-Jacking Attacks on YouTube and Why They're So Popular","type":"research","url":"https://www.bitdefender.com/blog/labs/a-deep-dive-into-stream-jacking-attacks-on-youtube-and-why-theyre-so-popular"}]},{"content":"No named individuals, companies, or specific threat-actor groups have been publicly and reliably identified as operating this scam network. SentinelLABS stated it could not determine whether one group or several unrelated operators were behind the contracts it analyzed. TRM Labs' 2026 report also did not name any individual or group, describing only wallet addresses and laundering paths. No regulatory enforcement action (SEC, CFTC, DOJ, or foreign equivalent) specific to this scam format was identified in available sources at the time of this investigation. This should be read as an alleged pattern of fraud attributable to an unknown number of unidentified operators, not a single company or legal entity.","heading":"Attribution and accountability","severity":"medium","sources":[{"credibility":2,"name":"TRM Labs: Fake AI Trading Bots Are Getting Victims to Build Their Own Drainers","type":"research","url":"https://www.trmlabs.com/resources/blog/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers"},{"credibility":2,"name":"CryptoSlate: Fake Ethereum trading bots on YouTube help scammers steal over $900K","type":"news_article","url":"https://cryptoslate.com/fake-ethereum-trading-bots-on-youtube-help-scammers-steal-over-900k/"}]}],"sources_used":[{"credibility":2,"name":"TRM Labs: Fake AI Trading Bots Are Getting Victims to Build Their Own Drainers","type":"research","url":"https://www.trmlabs.com/resources/blog/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers"},{"credibility":2,"name":"CryptoSlate: Fake Ethereum trading bots on YouTube help scammers steal over $900K","type":"news_article","url":"https://cryptoslate.com/fake-ethereum-trading-bots-on-youtube-help-scammers-steal-over-900k/"},{"credibility":2,"name":"Web3 Is Going Great: Traders lose $1 million to malicious 'trading bot' software","type":"news_article","url":"https://web3isgoinggreat.com/single/mev-bot-scam"},{"credibility":2,"name":"Radom: Sophisticated Trading Bots Execute AI-Fueled Scam on YouTube, Defrauding Crypto Investors of $1 Million","type":"news_article","url":"https://www.radom.com/insights/sophisticated-trading-bots-execute-ai-fueled-scam-on-youtube-defrauding-crypto-investors-of-1-million"},{"credibility":2,"name":"Towards Understanding and Characterizing the Arbitrage Bot Scam In the Wild (arXiv preprint)","type":"research","url":"https://arxiv.org/html/2310.12306v1"},{"credibility":3,"name":"Gridinsoft: OneinchSlippageBot Scam: YouTube AI Trading Bot Ads Explained","type":"research","url":"https://blog.gridinsoft.com/youtube-ads-ai-trading-scams/"},{"credibility":2,"name":"Bitdefender: A Deep Dive into Stream-Jacking Attacks on YouTube and Why They're So Popular","type":"research","url":"https://www.bitdefender.com/blog/labs/a-deep-dive-into-stream-jacking-attacks-on-youtube-and-why-theyre-so-popular"}],"summary":"This is a recurring pattern of YouTube-driven scams, run by multiple apparently unrelated operators, in which tutorial videos promise a free AI- or MEV-powered crypto \"arbitrage bot\" and walk viewers through deploying a smart contract via a Remix-styled compiler. The contract contains no trading logic and instead forwards deposited ETH to attacker-controlled addresses once the victim funds it and presses a button such as \"Start\" or \"Withdraw.\" Independent research from academia (2023) and threat-intelligence firms (2025-2026) documents thousands of such videos and tens of millions of dollars in alleged cumulative losses, with the scheme still active as of 2026.","timeline":[{"date":"2022-06","event":"Start of the one-year window in which an academic detection system began collecting the 10,442 arbitrage-bot scam videos later analyzed in the 'Towards Understanding and Characterizing the Arbitrage Bot Scam In the Wild' study.","source":"arXiv preprint 2310.12306","source_url":"https://arxiv.org/html/2310.12306v1"},{"date":"2023-10","date_evidence":"arXiv preprint identifier 2310.12306v1, with submission date reflected in the arXiv ID 2310 (October 2023)","date_original":"2023-10-18","event":"Academic paper quantifying the arbitrage-bot scam (10,442 scam videos, ~25,933 victim addresses, up to $15 million in estimated losses from June 2022-June 2023 data) is submitted to arXiv.","source":"arXiv preprint 2310.12306","source_url":"https://arxiv.org/html/2310.12306v1"},{"date":"2024","event":"SentinelLABS states the fake MEV/arbitrage bot YouTube campaign it later reported on had been active since this point, continuously evolving through new videos and accounts.","source":"CryptoSlate coverage of SentinelLABS research","source_url":"https://cryptoslate.com/fake-ethereum-trading-bots-on-youtube-help-scammers-steal-over-900k/"},{"date":"2025-08-07","date_evidence":"CryptoSlate article byline dated August 7, 2025 reporting the SentinelLABS findings","event":"SentinelLABS research describing fake AI-generated YouTube trading-bot tutorials draining over $900,000 (reported elsewhere as 'over $1 million') is published and covered by CryptoSlate and other outlets.","source":"CryptoSlate","source_url":"https://cryptoslate.com/fake-ethereum-trading-bots-on-youtube-help-scammers-steal-over-900k/"},{"date":"2026-02-12","date_evidence":"TRM Labs states drains in the campaign it analyzed ran 'from February 12, 2026 (earliest) to August 11, 2026 (most recent)'","event":"Earliest traced drain transaction in TRM Labs' 2026 'Claude-built' fake arbitrage bot campaign.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers"},{"date":"2026-04","event":"Earliest of nine near-identical YouTube tutorial videos advertising the fake 'Claude-built' arbitrage bot is posted, per TRM Labs.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers"},{"date":"2026-08-11","date_evidence":"TRM Labs states drains ran 'from February 12, 2026 (earliest) to August 11, 2026 (most recent)'","event":"Most recent traced drain transaction in the 2026 campaign, per TRM Labs; cumulative total reaches 274.60 ETH (~$517,205) from 224 victim wallets.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers"},{"date":"2026-09","event":"TRM Labs publishes its report; the nine traced tutorial videos had accumulated 310,474 combined views by this point.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers"}]},"v":1}