Fake Tutorials Dupes Traders Into Deploying Malicious Smart Contracts

Traders were duped into deploying their own malicious smart contracts after watching fake YouTube tutorials promising AI-built crypto arbitrage bots. Between February and August, 224 victims deployed and funded these contracts, draining a total of 274.60 ETH worth around $517,205 at the time of transfer.

The median loss was approximately 1 ETH per victim, according to TRM Labs' analysis. Unlike conventional drainer campaigns, this operation did not rely on victims signing malicious token approvals or visiting spoofed domains. Instead, each victim chose a tutorial, copied code, deployed a contract, and funded it from their own wallet.

The fake tutorials presented as the work of separate creators, with nine nearly identical videos promising an arbitrage bot built with Claude. The operators controlled compiler sites, some styled to resemble Remix development environment, where victims were directed to paste code that would be swapped for a different contract on the operator's server.