Imitation Claude Tutorial Scams 274 ETH
Blockchain analysis firm TRM Labs has revealed that a series of YouTube tutorials claiming to teach viewers how to build AI arbitrage bots using "Claude" are actually scams that lure viewers into deploying malicious smart contracts. TRM tracked that between February 12 and August 11, 2026, these tutorials led to the theft of 274.60 Ethereum (ETH, approximately $517,205 at the time of theft) from 224 wallet addresses.
The scam process involves the tutorial first enticing viewers to create a cryptocurrency wallet step by step, then guiding them to copy and paste "code" into a counterfeit compilation website that mimics the official Ethereum development tool, Remix. The counterfeit site quietly discards the clean code pasted by viewers on the server side, instead compiling and deploying malicious bytecode provided by the attacker's server, while viewers see "clean" source code on their screens. The tutorial then instructs viewers to inject 1 to 2 ETH into the newly deployed contract to "activate arbitrage functionality"; once the account balance exceeds 0.05 ETH, clicking the "start" or "withdraw" button in the tutorial will automatically transfer funds to the attacker's address.
Since the entire process is completed by the victims using their own wallets, without involving common phishing links, counterfeit domains, or malicious authorization signatures, it does not trigger the usual security warnings or authorization analysis alerts from wallets. This is a key reason why such scams can bypass mainstream wallet protection mechanisms. Some victims, after their initial funds were stolen, received a false error message claiming they needed to pay a "gas nonce liquidity" fee (a term that does not exist in the Ethereum technical framework), luring them into a second round of transfers.
TRM Labs identified 9 YouTube tutorials with nearly identical content, seemingly from different creators, but all using AI-generated host images and voiceovers, with completely consistent scripts. Even specific profit promises like "earn 1 ETH every 20 hours" are identical to the decimal point; these videos also fake user reviews in the comments section and hide key links in the video description to evade scrutiny. As of September 2026, these 9 videos have accumulated 310,474 views, with earlier versions having been removed by YouTube.
The stolen 274.60 ETH involved 224 victim wallets and 234 deployed malicious contracts, with a median loss of about 1 ETH per victim. TRM found that these funds were entirely transferred through decentralized channels—exchanging ETH for Dai stablecoin, transferring via cross-chain bridges, and laundering through mixing protocols, without passing through any centralized exchanges, ultimately splitting the funds into six addresses controlled by the attackers.
TRM Labs also released the "2026 AI Crime Application Index" report, showing that criminals (led by scammers) have increased their use of AI technology by 40% year-on-year. The methods of disguising scam videos as educational content using AI-generated material and mass copying of scam templates are typical manifestations of this growth trend. Notably, TRM clarified in the report that Claude itself was not actually involved in the writing or operation of these malicious contracts—no traces of any Anthropic products or AI functions were found in the deployed code, and the name "Claude" was merely used as a marketing gimmick for the scam. Similar scams using almost identical methods had previously appeared in 2025, using the name ChatGPT, indicating that attackers can switch popular AI brand names at any time to package the same scam script, with the real damage being to the reputation of the impersonated AI brand and inexperienced investors, while the attackers bear almost no technical development costs, only needing to change the brand name and packaging materials to cash out repeatedly.
Reports indicate that earlier versions of the tutorials used the name ChatGPT, employing the exact same scam mechanism, demonstrating that this "AI arbitrage bot" scam template is highly replicable, with attackers merely changing the marketing facade based on the most attention-grabbing AI brands at the time.
Source: Public Information
ABAB AI Insight
This type of "disguised AI tool tutorial to steal crypto assets" scam is not new—TRM Labs' investigation has confirmed that similar scams with almost identical mechanisms circulated on YouTube as early as 2025, when the brand used was ChatGPT instead of Claude; the historical behavior patterns of attackers show that they do not care which AI product name is used, but continuously track the most popular and recognizable AI brands in the market, replacing the brand identifiers in the tutorials to maintain the "freshness" and credibility of the scam content.
From a resource investment perspective, the attackers incur very low costs—by creating a set of AI-generated host images and voiceover templates, they can mass-produce 9 or more "seemingly from different creators" tutorial videos, requiring almost no additional content production costs; meanwhile, the stolen 274.60 ETH funds are rapidly dispersed and concealed through a complete decentralized financial infrastructure of exchanging ETH for Dai, transferring via cross-chain bridges, and laundering through mixing protocols, deliberately avoiding any centralized exchange steps that require identity verification, thus minimizing the risk of funds being tracked and frozen.
A comparable historical case is the long-standing "fake airdrop" and "fake customer service" phishing scams in the cryptocurrency industry—these scams share the common feature of exploiting victims' unfamiliarity with emerging technologies or platform mechanisms, luring them into completing key operations (such as authorization signatures, transfers, and contract deployments) that should have been performed by the attackers. The current new change is that the proliferation of generative AI allows attackers to produce "seemingly authoritative, seemingly from different channels" educational content at extremely low costs, marking a shift in crypto scams from the "manual phishing script" phase to the accelerated "AI-driven large-scale content production" phase.
This incident is essentially a technological substitution in the method of scam production: in the past, scammers needed to hire multiple real hosts to create a credible illusion of "multiple independent creators endorsing" the content, which was costly and inefficient; now, with AI-generated host images, voiceovers, and scripts, attackers can replicate content that is almost identical at near-zero marginal costs, creating a matrix of tutorial videos that "seemingly" come from different channels, replacing the credibility accumulated through real endorsements with the illusion of quantity and dispersed channels. Mechanistically, this also explains why such scams can continuously bypass traditional wallet security mechanisms—because the key actions in the entire attack chain (deploying contracts, transferring funds) are actively completed by the victims themselves under the psychological state of "thinking they are learning new technology," making it inherently difficult for security systems to distinguish between normal learning behavior and an induced attack chain.
ABAB News · Cognitive Laws
When the cost of scams drops to zero, the scale will rise to the maximum
The more it sounds like many people are saying it, the more likely it is that the same person is saying it
Money lost by one's own hands cannot be recovered or blamed on others