Fake AI Crypto Bot Tutorials Are Draining ETH: How to Spot the Malicious Contract

Direct answer: A new crypto scam does not ask you to connect to a fake site. Instead, fake AI trading-bot tutorials persuade viewers to deploy and fund malicious smart contracts themselves. TRM Labs says 224 victims lost 274.60 ETH, about $517,000 at the time of its analysis, to six shared collection addresses between February and August 2026.

How the scam works

The tutorial claims to show how to build an AI or arbitrage bot. The victim copies supplied Solidity code, deploys it using their own wallet and then sends ETH to the contract as “trading capital.” According to TRM Labs, the contract contains no real trading logic; it forwards the funded crypto to an address controlled by the operator.

Why normal phishing defenses can miss it

There may be no spoofed wallet website, malicious token approval or obvious phishing prompt. The user intentionally signs the deployment and funding transactions. That means browser blocklists and wallet warnings designed around known malicious domains may not trigger.

Checks before deploying tutorial code

Trace every value-moving path

Do not fund code you cannot explain. Identify where ETH can leave the contract, who controls destination addresses, whether an owner can change them, and what external contracts are called.

Do not trust comments or function names

A function named “startArbitrage” can still transfer funds directly to an attacker. Behavior is determined by executable code, not labels in the tutorial.

Use an isolated test environment

Compile and test unfamiliar code on a test network with valueless tokens. A tutorial telling you to fund mainnet immediately is a major warning sign.

Check independent analysis

Search exact contract code fragments, creator addresses and destination addresses. Do not rely on comments under the same video because scam campaigns can manufacture social proof.

If you already deployed or funded one

Stop sending funds. Record the deployment transaction, contract address, funding transactions and any destination addresses. If assets remain in a contract and you genuinely understand a safe withdrawal function, consider independent professional review before interacting further. Do not follow “recovery” instructions from strangers; a second scam often follows the first.

Official research

TRM Labs: Fake AI Trading Bots Are Getting Victims to Build Their Own Drainers.

FAQ

Can a contract drain funds without a phishing approval?

Yes. If you deploy and fund code that sends value to an attacker, the transaction can be fully authorized by you.

Does an AI-generated label make a bot legitimate?

No. Verify the actual code and on-chain behavior.

Can stolen crypto always be recovered?

No. On-chain transfers can be irreversible; preserve evidence and be skeptical of anyone promising guaranteed recovery.

This article is for security education and troubleshooting only, not investment advice. Never deploy or fund smart-contract code you do not independently understand and verify.