Fake AI trading bot tutorials on YouTube led to the theft of 274.6 ETH from 224 victims between Feb. 12 and Aug. 11, 2026, according to a Sept. 14 analysis by blockchain intelligence firm TRM Labs. The stolen cryptocurrency amounted to approximately $517,000.
The fraudulent scheme involved nine nearly identical YouTube tutorials that appeared to be from separate creators but showed clear signs of shared production. Each promised to teach viewers how to build an AI-powered arbitrage bot using tools like Claude.
Victims were guided through a step-by-step process: setting up a cryptocurrency wallet, copying provided code, deploying a smart contract, and funding it with their own digital assets. The promised arbitrage bot code was actually malicious, designed to transfer the victim's cryptocurrency directly to scam operators.
The campaign's core deception exploited a compiler-level attack. While victims were shown legitimate source code, the fake compiler deployed different bytecode. The smart contract ultimately deployed was not the one the victim believed they were creating. This method bypassed conventional wallet security warnings, phishing blocklists and approval-signature analysis. Victims themselves deployed the code they were shown, sent funds to a contract they technically owned, and authorized each transaction from their personal wallet, making detection difficult for standard security measures.
The coordinated nature was evident in identical scripts across YouTube channels, matching on-screen instructions, and several videos displaying the exact same claimed profits—including 1 ETH every 20 hours. To scale the deception, operators used AI-generated presenters and voices. Some tutorials featured an AI-generated presenter speaking directly to viewers, while others combined AI-generated voiceover with screen recordings.
Many videos obscured URLs shown on screen, instead directing viewers to links in video descriptions. This tactic allowed the same recording to be reused across different channels with only the destination link updated. Comment sections further reinforced the illusion with fabricated testimonials claiming the bot functioned as advertised.
TRM Labs noted a 40 percent year-on-year increase in AI adoption by criminals in its 2026 AI-in-Crime Adoption Index, with scammers leading this trend. This campaign demonstrates how AI has reached maturity in scamming, impacting every stage of the attack lifecycle.
As of September 2026, the nine identified videos remained online on YouTube, having collectively accumulated 310,474 views since the earliest was posted in April 2026. Six operator addresses were linked to receiving the stolen funds.
