Fake AI Trading Bots Are Getting Victims to Build Their Own Drainers

Key takeaways

• YouTube tutorials promising a Claude-built crypto arbitrage bot walk viewers step by step into deploying a smart contract that contains no trading logic and instead forwards any cryptocurrency they send it to the operator
• Between February and August 2026, 274.60 ETH (approximately USD 517,205) drained from 224 victims into six shared collection addresses, pointing to a likely coordinated operation behind the nominally separate tutorials
• Unlike conventional wallet-draining attacks, this scam involves no phishing link, spoofed domain, or malicious approval prompt — the victim deploys and funds the contract from their own wallet, so wallet warnings and phishing blocklists never fire
• The stolen funds move entirely through decentralized finance, cross-chain bridges, and a mixer, with no centralized exchange in the path

{{horizontal-line}}

Criminal adoption of AI is accelerating. TRM’s 2026 AI-in-Crime Adoption Index found AI adoption by criminals rising 40% year on year, with scammers leading that adoption. Scamming is one of the frontiers where AI adoption has reached a mature stage and is present on every part of the attack lifespan.

One such attack vector identified occurs on YouTube in the form of fake AI-trading bots and coding lessons. Videos promise to teach viewers how to build an AI-powered arbitrage bot with Claude, then walk them through the process step by step: setting up a wallet, copying code, deploying a smart contract, and funding it with cryptocurrency.

The victim chooses the tutorial, follows the instructions, and authorizes every transaction themselves.

The promised arbitrage bot is actually a malicious code. Anyone who follows the tutorial to the end deploys and funds a smart contract designed to send their cryptocurrency to the operators.

In one case, TRM identified nine nearly identical YouTube tutorials — presented as the work of separate creators but showing signs of a common production — that impacted at least 224 victims between February and August 2026. This is just one coordinated example of how AI can be used as a lure to scam victims out of their funds.

Why this scam evades conventional wallet defenses

Two features distinguish this from a conventional drainer campaign.

• Victims deploy and fund the malicious contract themselves, following instructions they actively sought out
• The process contains none of the signals typically associated with a wallet-draining attack — no phishing link, no spoofed domain, and no malicious approval prompt

That combination makes the campaign difficult for conventional defenses to detect. Wallet security warnings, phishing blocklists, and approval-signature analysis are designed to identify hostile sites or suspicious permissions. Here, the victim deploys code they have been shown, sends funds to a contract they own, and authorizes each step from their own wallet. The malicious code enters the process only through the fake compiler, which deploys a different bytecode from the source code shown to the victim.

The tutorials are manufactured at scale

The nine tutorials appear across different YouTube channels, each presented as the work of a separate creator. But the videos show signs of a common production behind them.

Scripts are nearly identical across channels, the on-screen instructions follow the same sequence, and several videos show the same claimed profits down to the decimal, including a return of 1 ETH every 20 hours.

The videos use AI-generated presenters and voices to create the appearance of different creators. Some feature an AI-generated presenter speaking directly to the viewer, while others pair an AI-generated voice with a screen recording. Many also obscure the URLs shown on screen and direct viewers to links in the video description instead, allowing the same recording to be reused across channels while the destination changes.

The comment sections include fabricated testimonials claiming that the bot works.

As of September 2026, the nine videos remain online and have accumulated 310,474 views since the earliest was posted in April 2026. Earlier versions of these videos were also identified using the same approach. These videos have since been removed from YouTube, indicating that the activity extends beyond the nine videos included in this analysis.

The tutorial format gives the scam an appearance of legitimacy. Viewers see a presenter work through the process in real time, with code on screen and a terminal showing each step. At the same time, the format is highly reusable because the same script and screen recording can be repackaged and distributed across multiple channels with relatively little additional production.

The written guides linked in the video descriptions show the same level of coordination. Although they are hosted across Telegraph, Amazon S3, and Google Cloud Storage and differ in their design and links, the instructions appear in the same order and culminate in the same step: fund the bot with sufficient liquidity and press Start.

Weaponizing trust in AI

Claude features prominently in the tutorials’ titles, descriptions, and scripts. One video promises to show viewers how to use Claude to build a “fully autonomous crypto trading bot from scratch,” adding that no prior experience is required.

The pitch is plausible because AI coding assistants genuinely help users write and deploy software, including trading applications, and are increasingly used to run real technical workflows end to end. The tutorials exploit that familiarity to make the promised arbitrage bot seem achievable even to viewers with limited technical experience. But Claude plays no role in what ultimately gets deployed. TRM found no Anthropic product or AI functionality in the contracts or compiler sites; the Claude name is used only to market the scheme.

The approach is not unique to Claude. Earlier versions of the same scam were identified in 2025 that used ChatGPT as the lure while relying on the same underlying mechanism. The shift toward Claude in 2026 shows how the operators can adapt the AI branding while leaving the mechanics of the scam largely unchanged.

A hidden swap deploys the drainer

The instructions given to the victims are legitimate until one step. Rather than directing viewers to an established development environment, the tutorials link to a code compiler site the operators built themselves, styled to resemble Remix. This occurred across several of the videos reviewed, which were hosted on Amazon S3, Google Cloud Storage, and standalone domains, with near-identical interfaces.

The site does not compile what the victim pastes into it. In one variant, a background script discards the pasted source entirely and compiles a different contract fetched from the operator’s server. The open-source code shown to the victim is a clean decoy containing nothing suspicious, and it never reaches the blockchain. What reaches the blockchain is a honeypot contract that accepts deposits and forwards any balance above 0.05 ETH to the operator the moment the victim calls Start or Withdraw, which is the same button the tutorial tells them to press. Nothing in the browser signals the substitution.

When the drain leaves a victim confused rather than certain they have been robbed, the operators ask for more money. One compiler site displayed a scripted error message after the funds were already gone: “ERROR: Arbitrage stuck — Gas nonce liquidity equals injected liquidity. Add 50% of your original liquidity (up to 1 ETH) as arbitrage gas to your bot’s smart contract, then press Start again.”

Gas nonce liquidity is not an Ethereum concept, and no such error exists in the deployed contract. The message is there to produce a second transfer.

274 ETH drained from 224 victims

TRM identified 234 smart contracts deployed and funded by victims, with funds ultimately flowing to six addresses controlled by the operators. Tracing those contracts back to their funders identified 224 victim wallets — the same onchain tracing that supported real-time victim identification in Operation Atlantic. This pattern mirrors the process laid out in the tutorials by having victims deploy a contract and fund it with their own wallet.

The median victim lost 1 ETH, consistent with instructions in the tutorials to provide 1 to 2 ETH in startup capital. In this particular example, the earliest drain occurred on February 12, 2026, and the most recent on August 11, 2026. In total, the six operator addresses received 274.60 ETH, worth approximately USD 517,205 at the time of the transfers.

The stolen funds then moved entirely through decentralized infrastructure. Some ETH was swapped into Dai through decentralized finance and same-chain swap services, while other funds moved across chains through several bridges, including one path that passed through a mixer. Some funds remain in the original receiving addresses or newly created wallets. TRM identified no centralized exchange in the outbound flow.

How to avoid deploying a drainer contract

Most of the steps in these tutorials are legitimate. The victim uses a real wallet, deploys a contract they control, and signs the transactions themselves. Even the source code shown on screen contains nothing malicious. The compromise occurs when the victim follows the tutorial to a compiler controlled by the operators, which substitutes with malicious bytecode the code the victim believes they are deploying.

That makes the development environment itself a security decision. Users should deploy contracts only through tools they independently choose and can verify, rather than through links supplied by tutorials, guides, or support channels. A malicious compiler can deploy bytecode that bears no relationship to the source code displayed on screen, while the resulting transaction still appears to come legitimately from the user’s own wallet.

A professional-looking tutorial, familiar AI brand, active comment section, or readable source code does not establish that the smart contract ultimately deployed onchain is the code a user was shown.

{{horiztonal-line}}

Frequently asked questions (FAQs)

1. What is a crypto wallet drainer?

A wallet drainer is code or a website built to move cryptocurrency out of a victim’s wallet and into an address the attacker controls. Most drainers rely on tricking a victim into signing a malicious approval or connecting to a spoofed site — one of many crypto scam types TRM tracks. In this campaign the drainer is a smart contract the victim deploys and funds themselves, which is why no approval prompt or phishing warning ever appears.

2. Is the Claude AI trading bot in these videos real?

No. The contracts these tutorials instruct viewers to deploy contain no arbitrage logic, no flash-loan interface, and no decentralized-exchange router calls. They contain no AI component of any kind, no model query and no API key. The AI branding exists only in the video titles, descriptions, and scripts.

3. Why didn’t my wallet warn me?

Wallet security warnings, phishing blocklists, and approval-signature analysis all target the moment a victim connects to a hostile site or signs a permission they do not understand. Neither moment occurs here. The victim deploys the contract from their own wallet and funds a contract they own.

4. How does the fake compiler work?

The site does not compile what you paste into it. A background script discards the pasted source and compiles a different contract fetched from the operator’s server. The clean code shown on screen never reaches the blockchain.

5. The site says my bot is stuck and needs more liquidity. Is that real?

No. Gas nonce liquidity is not an Ethereum concept. A failed flash loan reverts in full, and no mechanism requires additional funds to reset a prior execution. That message exists only to produce a second transfer.