Verify a decision

{"actor":"system:backfill","investigation_id":"c50902fb-dd54-4627-a2b8-3369205df0d7","kind":"publish","page_slug":"fake-ai-trading-bot-youtube-drainer-campaign-2026","published_at":"2026-10-06T22:35:00.196Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Fake AI Trading Bot YouTube Drainer Campaign (2026)","sections":[{"content":"According to TRM Labs, the operation ran from February to August 2026 and identified 224 victim wallets that deployed 234 smart contracts. TRM traced 274.60 ETH, valued at approximately USD 517,205 at the time of the transfers, to six operator collection addresses. The median loss per victim was 1 ETH. TRM identified nine nearly identical YouTube tutorials that had accumulated 310,474 cumulative views as of its report, with the earliest video posted in April 2026. TRM also noted that earlier versions of the videos had been removed from YouTube. Some secondary outlets report total losses above USD 1 million when additional variants are included; that figure was not confirmed in the primary TRM report reviewed here, and should be treated as unverified.","heading":"Campaign Overview and Scale","severity":"critical","sources":[{"credibility":2,"name":"TRM Labs: Fake AI Trading Bots Are Getting Victims to Build Their Own Drainers","type":"research","url":"https://www.trmlabs.com/resources/blog/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers"},{"credibility":2,"name":"Crypto Briefing: Fake Claude trading bot tutorials drain $517K from 224 crypto users","type":"news_article","url":"https://cryptobriefing.com/trm-labs-fake-ai-bot-tutorial-scam/"},{"credibility":2,"name":"The Defiant: Fake AI bot tutorials tricked 224 victims into deploying their own drainers","type":"news_article","url":"https://thedefiant.io/news/security/fake-ai-bot-tutorials-tricked-224-victims-into-deploying-their-own-drainers"}]},{"content":"The videos allegedly walked viewers through setting up a wallet, copying source code, deploying a contract and funding it. TRM reports that viewers were directed to compiler websites controlled by the operators, some styled to resemble the Remix development environment and hosted on Amazon S3, Google Cloud Storage and standalone domains. In one variant analyzed by TRM, a background script discarded the source code pasted by the victim and compiled a different contract fetched from the operator's server, so the clean code shown on screen never reached the blockchain. The substituted contract accepted deposits and forwarded any balance above 0.05 ETH to the operator when the victim pressed Start or Withdraw. The contracts reportedly contained no arbitrage logic or AI functionality. Because victims deployed and funded the contract from their own wallets, with no malicious approval signature or spoofed-domain interaction, the transactions appeared self-directed and conventional wallet warnings and phishing blocklists were not triggered.","heading":"Technical Mechanism","severity":"high","sources":[{"credibility":2,"name":"TRM Labs: Fake AI Trading Bots Are Getting Victims to Build Their Own Drainers","type":"research","url":"https://www.trmlabs.com/resources/blog/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers"},{"credibility":2,"name":"Crypto Briefing: Fake Claude trading bot tutorials drain $517K from 224 crypto users","type":"news_article","url":"https://cryptobriefing.com/trm-labs-fake-ai-bot-tutorial-scam/"}]},{"content":"The tutorials were presented as the work of separate creators but used AI-generated presenters and voiceovers, according to TRM. Crypto Briefing, summarizing TRM, reports fabricated testimonials and false profit claims. TRM states that Claude was not involved in the malicious contracts and that the Claude name was used only to market the scheme; Crypto Briefing reports similar campaigns in 2025 used ChatGPT branding with the same method. Crypto Briefing's article contained no statements from YouTube or Anthropic. No public attribution of the operators to a named individual or group was found in the sources reviewed.","heading":"Social Engineering, Branding and Use of AI","severity":"medium","sources":[{"credibility":2,"name":"TRM Labs: Fake AI Trading Bots Are Getting Victims to Build Their Own Drainers","type":"research","url":"https://www.trmlabs.com/resources/blog/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers"},{"credibility":2,"name":"Crypto Briefing: Fake Claude trading bot tutorials drain $517K from 224 crypto users","type":"news_article","url":"https://cryptobriefing.com/trm-labs-fake-ai-bot-tutorial-scam/"}]},{"content":"TRM reports that funds went to six operator collection addresses and that all outbound movement occurred through decentralized finance protocols, bridges and mixers, with no centralized exchange involvement observed. This limits the opportunity for exchange-based freezes. No law enforcement action, arrests or fund recoveries related to the 2026 campaign were found in the sources reviewed.","heading":"Fund Flows and Laundering","severity":"high","sources":[{"credibility":2,"name":"TRM Labs: Fake AI Trading Bots Are Getting Victims to Build Their Own Drainers","type":"research","url":"https://www.trmlabs.com/resources/blog/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers"},{"credibility":2,"name":"Crypto Briefing: Fake Claude trading bot tutorials drain $517K from 224 crypto users","type":"news_article","url":"https://cryptobriefing.com/trm-labs-fake-ai-bot-tutorial-scam/"}]},{"content":"Cointelegraph reported in August 2025 that SentinelLABS had identified a widespread and ongoing scheme, active since at least 2024, in which attackers allegedly used older, seemingly legitimate YouTube accounts to promote a crypto trading bot whose smart contract concealed the attacker's wallet. Victims were reportedly asked to deposit at least 0.5 ETH, and over 256 ETH (about USD 939,000) was reported stolen across identified scammer wallets. Red flags cited included AI-generated videos, deleted negative comments and fake testimonials. This is a separate, earlier report; a direct link between its operators and the 2026 campaign has not been established in the sources reviewed.","heading":"Precedent: 2025 YouTube Trading Bot Contract Scam","severity":"medium","sources":[{"credibility":2,"name":"Cointelegraph: Crypto trading bot scam on YouTube (SentinelLABS findings)","type":"news_article","url":"https://cointelegraph.com/news/crypto-trading-bot-scam-youtube-eth-theft"},{"credibility":2,"name":"SentinelOne: Smart Contract Scams, Ethereum Drainers Pose as Trading Bots to Steal Crypto","type":"research","url":"https://www.sentinelone.com/?p=125939"}]},{"content":"TRM's recommendation is to deploy contracts only through independently verified tools and never through tutorial-supplied links. Generally, promises of automated, risk-free arbitrage profits from a copy-and-paste bot are an indicator of alleged fraud.","heading":"Guidance for Users","severity":"low","sources":[{"credibility":2,"name":"TRM Labs: Fake AI Trading Bots Are Getting Victims to Build Their Own Drainers","type":"research","url":"https://www.trmlabs.com/resources/blog/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers"}]}],"sources_used":[{"credibility":2,"name":"TRM Labs: Fake AI Trading Bots Are Getting Victims to Build Their Own Drainers","type":"research","url":"https://www.trmlabs.com/resources/blog/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers"},{"credibility":2,"name":"Crypto Briefing: Fake Claude trading bot tutorials drain $517K from 224 crypto users","type":"news_article","url":"https://cryptobriefing.com/trm-labs-fake-ai-bot-tutorial-scam/"},{"credibility":2,"name":"The Defiant: Fake AI bot tutorials tricked 224 victims into deploying their own drainers","type":"news_article","url":"https://thedefiant.io/news/security/fake-ai-bot-tutorials-tricked-224-victims-into-deploying-their-own-drainers"},{"credibility":2,"name":"Cointelegraph: Crypto trading bot scam on YouTube (SentinelLABS findings)","type":"news_article","url":"https://cointelegraph.com/news/crypto-trading-bot-scam-youtube-eth-theft"},{"credibility":2,"name":"SentinelOne: Smart Contract Scams, Ethereum Drainers Pose as Trading Bots to Steal Crypto","type":"research","url":"https://www.sentinelone.com/?p=125939"}],"summary":"A campaign documented by blockchain analytics firm TRM Labs in which nine near-identical YouTube tutorials, marketed as teaching viewers to build an AI-powered arbitrage trading bot with Claude, allegedly led 224 victims to deploy and fund malicious smart contracts between February and August 2026, with 274.60 ETH (about USD 517,205 at the time of transfer) routed to six operator addresses. TRM states the Claude name was used only for marketing and that the scheme involved no phishing link or token approval. It follows an earlier, similar scheme reported by SentinelLABS in 2025.","timeline":[{"date":"2024","event":"SentinelLABS later reported that a similar YouTube trading bot smart contract scam had been active since at least 2024.","source":"Cointelegraph","source_url":"https://cointelegraph.com/news/crypto-trading-bot-scam-youtube-eth-theft"},{"date":"2025-08","event":"SentinelLABS findings on hijacked YouTube accounts promoting a fake trading bot contract (over 256 ETH stolen) were reported by Cointelegraph.","source":"Cointelegraph","source_url":"https://cointelegraph.com/news/crypto-trading-bot-scam-youtube-eth-theft"},{"date":"2026-02","event":"TRM Labs' observed window of victim losses began (reported as running from February to August 2026).","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers"},{"date":"2026-04","event":"Earliest of the nine identified YouTube tutorial videos was posted.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers"},{"date":"2026-08","event":"End of TRM's observed victim-loss window; 274.60 ETH traced to six operator addresses across 224 victims.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers"},{"date":"2026-09","event":"TRM Labs published its report on the campaign; Crypto Briefing and other outlets covered it shortly after.","source":"TRM Labs / Crypto Briefing","source_url":"https://cryptobriefing.com/trm-labs-fake-ai-bot-tutorial-scam/"}]},"v":1}