Over $1 million has been drained from crypto users through a sophisticated scam involving malicious smart contracts masquerading as MEV (Maximal Extractable Value) trading bots. The fraudulent campaign, uncovered by SentinelLabs, exploited AI-generated YouTube videos, aged accounts, and obfuscated Solidity code to target unsuspecting users.
These YouTube videos, often featuring AI avatars and synthetic voices, were used to dramatically reduce production costs while increasing the speed and scale of content creation. Hosted on long-standing YouTube accounts with unrelated content, the videos were either listed publicly with manipulated comment sections or distributed privately through Telegram and DMs to appear more credible.
Hidden contracts, fake tutorials, real losses
The scam centered around a deceptive smart contract, pitched as a profitable arbitrage bot. Victims were instructed to deploy the code using Remix, fund the contract with ETH, and execute a function named “Start().” However, instead of running any trading strategy, the contract rerouted deposited funds to wallets controlled by the attacker. To evade detection, the attacker used XOR obfuscation to scramble wallet addresses and applied large decimal-to-hexadecimal conversions to make the destination harder to trace.
One of the most successful wallets, linked to a still-live tutorial by YouTube user @Jazz_Braze, collected 244.9 ETH nearly $902,000 from victims. This wallet alone accounted for the majority of stolen funds, although many others reportedly netted five-figure sums. According to SentinelLabs, each contract set both the victim’s and attacker’s wallets as co-owners. Even if victims didn’t interact with the contract beyond deployment, fallback mechanisms were built in to enable fund withdrawal by the attacker.
Funds were subsequently funneled through secondary addresses to obscure the source and complicate forensic analysis. SentinelLabs has warned users not to trust free MEV bots promoted on social media and to avoid deploying unfamiliar smart contracts, even on testnets, without a full audit.