Crypto Trader Bot Scam on YouTube Drains 256 ETH from Users

Highlights:

• Crypto trader bot scam stole over 256 ETH from users.
• AI-generated YouTube videos disguised the malicious smart contracts.
• Wallet 0x8725…6831 collected nearly $900K in stolen ETH.

A new report from SentinelLABS has revealed a crypto trader bot scam that drained over $1 million in Ethereum. The activity consisted of old YouTube accounts and fake trading bots advertised by AI with video production.

Old YouTube accounts were used by hackers in order to pretend to be crypto educators. These accounts, which once focused on investing and news, now push fake tutorials. The scammers used tools disguised as MEV arbitrage bots and told viewers to deploy them via Remix IDE. Victims were to send ETH into a contract and execute a function labeled “Start().” The funds were instead directed into attacker wallets instead of profits. SentinelLABS discovered that these contracts possessed obfuscated code to conceal the final destination of the assets.

🚨 Crypto trader bot scam on YouTube looted 256 ETH: SentinelLABS. Aged YouTube accounts with a history of posting crypto news and investing tips have been taken over by bad actors to advertise a scam trading bot that steals crypto.

— Crypto News 📰 (@btc_af) August 7, 2025

Obfuscated Smart Contracts Hide Wallets

The attackers encoded their wallet addresses with XOR encoding and large decimal-to-hex conversions. Through this method, they were able to bypass regular code review. Other contracts involved string concatenation to further conceal the EOA of the attacker. Upon deployment, every smart contract establishes two owners: the user and the scammer. The attacker could withdraw the funds through fallback methods even before activating the main function. This design caused cautious users to experience losses as well.

Among the top addresses mentioned in the report, the address 0x8725…6831 obtained 244.9 ETH, worth more than $900,000. This address was accompanied by a video on a YouTube channel called @Jazz_Braze, which still exists and currently has more than 387,000 views.

Users were lured through videos titled “A Step-by-Step Guide to Creating an Ethereum Uniswap Sniper Bot” and “How to Create Passive Income MEV Bot on Ethereum.” They both looked AI-generated, had low production quality, and high visibility.

AI-Generated Videos Fuel the Deception

Scale content was heavily exploited by scammers using AI. In addition, the video was accompanied by robotic narration, awkward lip syncs, and generic avatars. These factors lowered the production cost and made it possible to produce hundreds of videos with very little effort.

The YouTube channels that participated in the scam used to publish unrelated or pop culture content. This plan assisted in the creation of credibility and concealed the quick switch to crypto content. According to SentinelLABS, the accounts were either hacked or purchased in Telegram groups and online listings. Active moderation of video comments took place. Moreover, negative reviews were deleted, and false testimonials occupied their place with promises of success. Victims were further convinced by the illusion of credibility to implement the instructions regarding deployment.

Multiple Wallets, Mixed Success

Even though one wallet won a lot, the rest of them got smaller ones. One of them had 7.59 ETH, and another had 4.19 ETH. Collectively, the campaign has drained more than 256 ETH from different users since early 2024. According to SentinelLABS, the stolen ETH moved through over 20 secondary wallets. These transfers disintegrated the trail, and it became hard to track. This model of the scam enabled it to grow and effectively conceal the money flow.

To date, the scam continues to operate. SentinelLABS confirmed that it is still spreading on social media platforms, mainly on Telegram. Users continue to be prompted to copy and implement smart contracts, diverting funds to the wallets of attackers.

Alex Delamottea, SentinelLABS researcher, stated, “These scams will inevitably work on victims who fail to scrutinize how these tools operate.” The bots were deployed in a manual fashion, so the victims did not suspect any secret permissions or fallback functionalities.