preferred on
Point of Focus
- Fake Claude bot tutorials drained $517,000 from 224 crypto users.
- Malicious compilers secretly replaced legitimate code with wallet drainers.
- The scam bypassed warnings because victims authorized every transaction.
Crypto scammers stole more than $517,000 by convincing victims to build, deploy, and fund their own wallet-draining smart contracts through fake YouTube tutorials, according to blockchain intelligence firm TRM Labs.
The videos claimed to teach viewers how to create an AI-powered crypto arbitrage bot using Anthropic’s Claude. Instead, users who completed the tutorials deployed contracts designed to transfer their Ether (ETH) directly to addresses controlled by the operators.
TRM identified 224 victim wallets that collectively lost 274.60 ETH, worth approximately $517,205 when the transfers occurred.
The median loss was 1 ETH, matching the tutorials’ recommendation to deposit between 1 ETH and 2 ETH as startup capital.
Victims authorized every transaction
Unlike conventional crypto drainers, the campaign did not rely on a recognizable phishing page or suspicious token approval request. Victims found the tutorials themselves, copied the displayed code, connected their own wallets, and approved every transaction.
The deception occurred at the compilation stage. The tutorials directed viewers to fake development platforms designed to resemble Remix, Ethereum’s widely used smart contract environment.
Fake AI trading-bot tutorials on YouTube walk victims into deploying their own drainers. TRM traced 274.60 ETH from 224 victims.
Read the analysis here ➡️ https://t.co/M0GljMO7Ok pic.twitter.com/kC1q9GNGbE
— TRM Labs (@trmlabs) September 18, 2026
Although victims saw apparently legitimate source code, the fraudulent compiler discarded it and deployed different bytecode obtained from the scammers’ server. The resulting contract contained no trading or arbitrage functions.
Once funded, it forwarded balances above 0.05 ETH to the operators when victims pressed “Start” or attempted to withdraw.
Some victims then received a fabricated error claiming they needed to add another 50% of their original deposit to resolve a “gas nonce liquidity” problem. No such Ethereum mechanism exists, TRM said.
AI-generated tutorials manufactured at scale
TRM connected nine nearly identical videos published across supposedly independent YouTube channels.
The tutorials used AI-generated presenters and voices, repeated the same scripts, and displayed matching profit figures.
Scammers found a way to make people drain their own wallets without sending them a phishing link.
They uploaded YouTube tutorials showing people how to build an AI crypto trading bot with Claude.
People followed the tutorial themselves.
Copied the code.
Deployed the smart…
— wyck 📴 (@wyckoffweb) September 20, 2026
Their comment sections also contained fabricated testimonials intended to reassure prospective users. By September, the nine videos had accumulated more than 310,000 views.
Claude’s name served only as a marketing lure. TRM found no Anthropic technology or AI functionality inside the contracts or fake compiler platforms. Similar campaigns used ChatGPT branding in 2025.
Stolen ETH moved through DeFi
TRM traced 234 victim-deployed contracts to six collection addresses, suggesting a coordinated operation active between February and August.
The stolen funds moved exclusively through decentralized infrastructure.
Operators swapped some ETH into Dai (DAI), transferred other funds through cross-chain bridges, and routed one portion through a crypto mixer. TRM found no centralized exchange in the outbound flow.
The campaign shows why users should independently verify development environments and confirm that deployed bytecode matches the source code before funding any smart contract.
Share
Most read articles
