A recent report by SentinelLABS has uncovered a scam that has drained over $1 million from crypto users through malicious smart contracts disguised as MEV trading bots. The scammers used AI-generated YouTube videos, aged accounts, and complex Solidity code to evade detection and gain access to cryptocurrency wallets. These videos featured AI-generated avatars and voices, allowing the scammers to produce content at a lower cost and scale up their operations.
The tutorials were posted on aged YouTube accounts with manipulated comment sections to create the illusion of credibility, and in some cases, the videos were unlisted and distributed via Telegram or direct messages. At the center of the scam was a smart contract promoted as a profitable arbitrage bot, which in reality routed funds to a concealed attacker-controlled wallet using techniques such as XOR obfuscation and decimal-to-hex conversions to mask the destination address. The most successful identified address received 244.9 ETH, approximately $902,000, via deposits from unsuspecting users. The scammers' use of fallback mechanisms allowed them to withdraw deposited funds even if the victim did not activate the main function.
SentinelLABS warns users to be cautious of 'free bots' advertised on social media, especially those involving manual smart contract deployment, and to thoroughly review code deployed in testnets to avoid similar tactics.