Fake Claude trading bot tutorials drain $517K from 224 crypto users

Fake YouTube tutorials promising to help users build crypto arbitrage bots with Anthropic’s Claude drained more than $517,000 in Ethereum from at least 224 victims, according to blockchain intelligence firm TRM Labs.

TRM identified nine similar tutorials that directed viewers through what appeared to be the process of building an AI powered trading bot. Instead, victims deployed and funded smart contracts designed to transfer their crypto to addresses controlled by the operators.

Between February and August, the campaign collected 274.60 ETH across six operator controlled addresses, worth about $517,205 at the time of the transfers. TRM identified 234 victim deployed contracts connected to 224 wallets, with the median victim losing 1 ETH.

The scam differs from conventional wallet drainers because users authorized every transaction themselves. There was no phishing website, malicious approval request, or spoofed wallet connection for security systems to detect.

The key manipulation occurred through fake compiler websites designed to resemble the Ethereum development tool Remix. TRM found that one version discarded the source code pasted by the victim and instead deployed malicious code fetched from the operator’s server. 

The resulting contract transferred balances above 0.05 ETH when users pressed the Start or Withdraw buttons shown in the tutorials.

Claude itself was not involved in the malicious contracts. TRM found no Anthropic product or AI functionality in the deployed code, with the Claude name used only to market the scheme. 

The firm said similar scams identified in 2025 previously used ChatGPT branding while relying on the same underlying method.

The videos used AI generated presenters and voices, similar scripts, fabricated testimonials, and repeated profit claims to appear legitimate. The nine identified videos had accumulated more than 310,000 views as of September.

TRM said the stolen funds were moved entirely through decentralized infrastructure, including DeFi services, cross chain bridges, and a mixer. It identified no centralized exchange in the outbound flow.