Fake AI Trading Bot Scam Steals 274.6 ETH

A wave of YouTube tutorials promising viewers an easy way to build an AI-powered crypto arbitrage bot has instead drained 274.6 ETH, worth roughly $517,000, from 224 victims, according to a new report from blockchain analytics firm TRM Labs published September 19.

The campaign ran between February and August 2026, and TRM Labs traced the stolen funds to six shared collection addresses, a pattern that points to a single, coordinated operation rather than scattered, independent scammers. Investigators identified nine nearly identical tutorial videos, each presented under a different creator identity and featuring AI-generated hosts and voiceovers, that together had racked up more than 310,000 views by the time the report was published.

What makes the scam notable is how little it resembles a conventional theft. The tutorials walk viewers through a legitimate-looking process: create a wallet, copy the provided code, deploy a smart contract, and fund it to start trading. Every step is one the victim performs themselves, with their own wallet, using transactions they personally authorize. There is no phishing link, no spoofed website, and no malicious approval prompt for a wallet's built-in warnings to catch. The contract simply does not do what the video claims.

How the Trap Actually Works

According to TRM Labs, the code shown and explained on screen during the tutorial is never what actually ends up on-chain. A backend script silently swaps out the source code the victim pastes in for a different, malicious contract pulled from the operator's own server, one built purely to forward any cryptocurrency sent to it straight to the scammer. Because the victim believes they are deploying the code they just watched explained line by line, the entire process feels transparent even though the real logic never touches their screen.

Once stolen, the funds do not pass through a centralized exchange, where they might be frozen or flagged. Instead, TRM Labs found the ETH moving through decentralized finance protocols, cross-chain bridges, and a mixing service, a routing choice that makes the money considerably harder to trace or recover once it leaves a victim's wallet.

The report places this campaign inside a broader trend. TRM Labs' own 2026 AI Crime Application Index found that criminal use of artificial intelligence tools rose 40% year-over-year, with scammers increasingly using AI to generate convincing tutorial content, fake trading tools, and automated social engineering at a scale that would have required far more manual effort in previous years.

Scams like this one tend to draw less attention during weeks when the market itself is the bigger story, such as this one, when Zcash was setting a fresh all-time high and whale wallets were moving hundreds of millions of dollars in full public view on-chain. But the same transparency that lets analysts track a legitimate whale in real time is what eventually let TRM Labs trace this scam's stolen funds back to a handful of shared addresses.

The case sits alongside other recent examples of blockchain analytics firms and international law enforcement tightening the net on crypto-focused threat actors. Earlier this month, authorities in Japan, the United States and Germany jointly exposed North Korea's WaterPlum crypto hacking network, another case where patient, coordinated tracking eventually unraveled a scheme built to look ordinary on its surface. Both cases underline the same lesson for crypto users: the more legitimate a tutorial, announcement, or contract looks, the more worth double-checking it becomes, especially when it asks you to deploy code you cannot fully verify yourself.

FAQ

How much was stolen and from how many people?
TRM Labs traced 274.6 ETH, worth about $517,000, stolen from 224 victims between February and August 2026.

Did the victims click a phishing link?
No. Victims followed the tutorial's own instructions to create a wallet, deploy a smart contract, and fund it themselves, which is why standard wallet security warnings never triggered.

How did the scam hide its malicious code?
A backend script replaced the legitimate-looking code shown in the video with a different malicious contract pulled from the operator's server before it was actually deployed on-chain.

Can the stolen funds be recovered?
TRM Labs found the ETH routed through DeFi protocols, cross-chain bridges, and a mixer rather than a centralized exchange, making recovery significantly harder than in thefts that touch regulated platforms.