{"id":420269,"date":"2026-09-28T16:14:35","date_gmt":"2026-09-28T16:14:35","guid":{"rendered":"https:\/\/malwaretips.com\/blogs\/?p=420269"},"modified":"2026-09-28T16:14:35","modified_gmt":"2026-09-28T16:14:35","slug":"ai-crypto-arbitrage-bot-scam-fake-claude-tutorials","status":"publish","type":"post","link":"https:\/\/malwaretips.com\/blogs\/ai-crypto-arbitrage-bot-scam-fake-claude-tutorials\/","title":{"rendered":"AI Crypto Arbitrage Bot Scam: Fake Claude Tutorials That Drain ETH Wallets"},"content":{"rendered":"<p>A video promises to show you how to build a crypto arbitrage bot with Claude. The instructions look approachable, even if you have never written a contract.<\/p><div id=\"mwtad2334910992\" class=\"gas_fallback-ad_309684--placement_406659\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"3957935887\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n<p>Before funding anything, pay attention to the tool the tutorial asks you to use. That one choice can change what actually reaches the blockchain.<\/p>\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" class=\"wp-image-420270 lazyload\" alt=\"Illustrative video page promoting a Claude AI crypto arbitrage bot tutorial\" width=\"1536\" height=\"1024\" title=\"\" sizes=\"auto, (max-width: 1536px) 100vw, 1536px\" data-src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/09\/ai-bot-video-v2.png\" data-srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/09\/ai-bot-video-v2.png 1536w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/09\/ai-bot-video-v2-300x200.png 300w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/09\/ai-bot-video-v2-1024x683.png 1024w\"><\/figure>\n<div id=\"mwtad425384783\" class=\"gas_fallback-ad_309746-ad_309685-placement_406660\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"4456629336\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2>Overview<\/h2>\n<h3>The promise is a self-built trading machine<\/h3>\n<p>In September 2026, <a href=\"https:\/\/www.trmlabs.com\/resources\/blog\/fake-ai-trading-bots-are-getting-victims-to-build-their-own-drainers\" target=\"_blank\" rel=\"noopener\">TRM Labs described<\/a> YouTube tutorials presenting an AI-powered arbitrage bot that viewers could supposedly build with Claude.<\/p><div id=\"mwtad784625912\" class=\"gas_fallback-ad_381396-ad_309685-placement_406667\" style=\"margin-top: 50px;margin-bottom: 50px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"1471373341\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n<p>The videos guided people through a wallet setup, source code, contract deployment, and funding. That sequence resembled an educational coding lesson.<\/p>\n<p>But the contract deployed through the operators&#8217; compiler had no genuine trading logic. It was designed to forward deposited cryptocurrency to the operators.<\/p>\n<p>Claude was the marketing hook, not a component of the deployed contracts. TRM found no Anthropic product or AI functionality in the scam&#8217;s contract or compiler.<\/p><div id=\"mwtad800707496\" class=\"gas_fallback-ad_309686-ad_309685-placement_406668\" style=\"margin-top: 50px;margin-right: 10px;margin-bottom: 50px;margin-left: 10px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"6935453015\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n<h3>The reported harm was measurable<\/h3>\n<p>TRM traced one coordinated cluster of nine similar videos to 224 victim wallets and 274.60 ETH taken between February and August 2026.<\/p>\n<p>The research valued that ETH at approximately $517,205 at the time of the transfers. Those figures describe the analyzed cluster, not every fake bot tutorial online.<\/p>\n<p>The same study found 234 deployed and funded contracts and six collection addresses associated with that cluster.<\/p><div id=\"mwtad1953840194\" class=\"gas_fallback-ad_381401-ad_309685-placement_406669\" style=\"margin-top: 50px;margin-right: 10px;margin-bottom: 50px;margin-left: 10px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"5315249587\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n<p>Several videos looked like separate creators, but their scripts, figures, and linked guides were strikingly similar.<\/p>\n<h3>Why this is different from a standard wallet phishing page<\/h3>\n<p>The victim did not need to connect a wallet to a spoofed exchange or approve a hostile token allowance.<\/p>\n<div id=\"mwtad863763775\" class=\"gas_fallback-ad_381404-ad_309685-placement_406670\" style=\"margin-top: 50px;margin-right: 10px;margin-bottom: 50px;margin-left: 10px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"8735619847\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><p>Instead, they deployed a contract and funded it themselves. The deceptive step was the compiler that substituted different bytecode for the displayed source.<\/p>\n<ul>\n<li>The tutorial claimed an AI trading strategy that the deployed contract did not contain.<\/li>\n<li>Viewers were sent to an operator-controlled compiler.<\/li>\n<li>The code shown on screen was not the code that reached the blockchain.<\/li>\n<li>Funding the contract exposed the deposit to its hidden transfer logic.<\/li>\n<li>A later error message could demand yet more cryptocurrency.<\/li>\n<\/ul>\n<p>That sequence makes the AI crypto arbitrage bot scam especially deceptive for people who expect their wallet to warn them about a malicious approval.<\/p>\n<div id=\"mwtad2738291948\" class=\"gas_fallback-ad_309747-ad_309685-placement_406661\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"9589536513\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2>Why the Tutorial Format Builds Trust<\/h2>\n<p>A long video feels different from an anonymous ad. It appears to teach, demonstrate, and let the viewer repeat each action.<\/p>\n<div id=\"mwtad2678066620\" class=\"mwtadp5 mwtadentity-placement\" style=\"margin-top: 50px;margin-bottom: 50px;\"><script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block; text-align:center;\"\r\n     data-ad-layout=\"in-article\"\r\n     data-ad-format=\"fluid\"\r\n     data-ad-client=\"ca-pub-7750719144850257\"\r\n     data-ad-slot=\"8560433799\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script><\/div><p>The presenter may look like a real coding instructor. TRM found AI-generated presenters and voices in some of the reviewed videos.<\/p>\n<p>Other versions paired an AI voice with screen recordings. The scripts and claimed profit figures were similar despite different channels.<\/p>\n<p>That repetition matters because it can create an illusion of independent success. Several creators appearing to prove the same result may actually share one production process.<\/p>\n<div id=\"mwtad1525076568\" class=\"mwtadp6 mwtadentity-placement\" style=\"margin-top: 50px;margin-bottom: 50px;\"><script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block; text-align:center;\"\r\n     data-ad-layout=\"in-article\"\r\n     data-ad-format=\"fluid\"\r\n     data-ad-client=\"ca-pub-7750719144850257\"\r\n     data-ad-slot=\"4034304343\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script><\/div><p>Comments claiming the bot worked can deepen the impression. TRM identified fabricated testimonials in the comment sections.<\/p>\n<p>The guide links also appeared in different places, including Telegraph, Amazon S3, and Google Cloud Storage. Different hosting did not make the instructions independent.<\/p>\n<p>According to the research, those guides converged on the same endpoint: deploy the bot, provide liquidity, and press Start.<\/p>\n<p>None of this means every AI-assisted trading tutorial is fraudulent. The concern is the verified chain of substitution and fund diversion in this campaign.<\/p>\n<div id=\"mwtad46504572\" class=\"gas_fallback-ad_309748-ad_309685-placement_406662\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"3906789406\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2>How the AI Crypto Arbitrage Bot Scam Works<\/h2>\n<h3>Step 1: A video makes automated profit sound buildable<\/h3>\n<p>The title combines Claude, crypto arbitrage, and a beginner-friendly promise. It suggests the difficult part of trading can be delegated to an AI tool.<\/p>\n<p>Real arbitrage is complex and competitive. It depends on execution costs, liquidity, timing, and market conditions, none of which disappear because a tutorial says \u201cAI.\u201d<\/p>\n<p>In the researched cluster, videos presented polished walkthroughs and similar profit claims. Viewers could mistake production quality for evidence of working software.<\/p>\n<p>Pause before treating a demonstrated balance or comment as independent proof. Both can be selected or fabricated by the uploader.<\/p>\n<h3>Step 2: The written guide moves the viewer to a chosen tool<\/h3>\n<p>Video descriptions linked to written instructions. Those guides differed visually, but TRM observed near-identical order and final funding instructions.<\/p>\n<p>This is the crucial handoff. A guide can choose the website where you compile, deploy, and fund the supposed bot.<\/p>\n<p>The site may look like a familiar development environment. Appearance cannot establish that it handles the code you pasted honestly.<\/p>\n<p>Do not treat a cloud-hosted guide as automatically safer. A legitimate hosting provider can carry content placed there by an attacker.<\/p>\n<h3>Step 3: A fake compiler swaps the contract<\/h3>\n<p>TRM found operator-controlled compiler sites styled to resemble Remix, a genuine smart-contract development environment.<\/p>\n<p>In one analyzed variant, the site discarded the source code the viewer pasted and compiled different code obtained from the operator&#8217;s server.<\/p>\n<p>The clean source shown to the victim was a decoy. It never became the on-chain bytecode they thought they were deploying.<\/p>\n<p>This is a supply-chain deception at the tool boundary. The victim can read apparently harmless code and still deploy something different.<\/p>\n<h3>Step 4: The victim deploys and funds the contract<\/h3>\n<p>The wallet signs ordinary deployment and funding transactions initiated by its owner. That is why a standard phishing-warning pattern may not appear.<\/p>\n<p>The operator-controlled contract accepts the funds, but it does not execute arbitrage trades. Its logic routes value toward the criminal collection addresses.<\/p>\n<p>TRM reported that the studied variant forwarded balances above a threshold when the user pressed Start or Withdraw.<\/p>\n<p>The image below illustrates the funding stage in a fictional guide. It does not show the actual malicious compiler or executable code.<\/p>\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" class=\"wp-image-420271 lazyload\" alt=\"Illustrative fake AI arbitrage bot guide directing a user to deploy and fund a contract\" width=\"1536\" height=\"1024\" title=\"\" sizes=\"auto, (max-width: 1536px) 100vw, 1536px\" data-src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/09\/ai-bot-guide.png\" data-srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/09\/ai-bot-guide.png 1536w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/09\/ai-bot-guide-300x200.png 300w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/09\/ai-bot-guide-1024x683.png 1024w\"><\/figure>\n<p>Do not copy a contract from this or any unverified tutorial into a wallet workflow. An on-chain action is difficult to reverse.<\/p>\n<h3>Step 5: The apparent bot diverts the deposit<\/h3>\n<p>The operator receives funds through the contract&#8217;s hidden behavior. From the victim&#8217;s perspective, the bot may simply seem to fail or show a confusing result.<\/p>\n<p>TRM followed the money through decentralized swaps, bridges, and a mixer in the analyzed cluster. It found no centralized exchange in the outbound path.<\/p>\n<p>That tracing supports the conclusion that the tutorial did not merely teach a bad strategy. The deposited funds were redirected.<\/p>\n<p>The research gives aggregate results. It does not mean every viewer of one video deposited cryptocurrency or lost the same amount.<\/p>\n<h3>Step 6: A fake error asks for a second deposit<\/h3>\n<p>One operator-controlled compiler displayed an error claiming the bot needed additional liquidity after the funds had already gone.<\/p>\n<p>The message used technical-sounding words about gas and nonce, but TRM said the supposed condition was not a real Ethereum concept.<\/p>\n<p>That false explanation turned a loss into a new sales pitch: add more cryptocurrency and try again.<\/p>\n<p>If a bot needs money to \u201cunlock\u201d money already sent, stop. Do not fund another transaction to test the claim.<\/p>\n<div id=\"mwtad3538083358\" class=\"gas_fallback-ad_318930-ad_309685-placement_406663\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"3818335085\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2>What Claude and the Wallet Actually Did<\/h2>\n<p>Claude is a real AI service. The researchers did not find it performing the alleged trading inside this campaign&#8217;s contracts.<\/p>\n<p>The wallet is also real. It signed transactions that its owner approved, which is why ordinary account-security checks might show no unauthorized login.<\/p>\n<p>The deception sat between the code the viewer believed they were deploying and the bytecode supplied by the chosen compiler.<\/p>\n<p>That separation is hard for a beginner to spot. A readable source window is comforting, but it does not prove the deployed contract matches it.<\/p>\n<p>Developers can verify bytecode and use trusted, independently selected tools. If those steps are unfamiliar, do not deploy a contract involving real funds.<\/p>\n<p>A professional-looking video or large view count cannot substitute for an independent technical review of what the contract actually does.<\/p>\n<div id=\"mwtad1085023804\" class=\"gas_fallback-ad_381388-ad_309685-placement_406705\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"3191649120\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2>How to Check a Crypto Bot Tutorial Before You Risk Funds<\/h2>\n<p>Ask whether the creator gives a verifiable contract source, an independently reproducible build, and a clear explanation of how trades would happen.<\/p>\n<p>Be wary when the tutorial insists on one obscure compiler link rather than allowing a trusted development environment chosen by you.<\/p>\n<p>Look for the actual trading components in the deployed contract, not just the pasted text in a browser window.<\/p>\n<p>Do not assume a well-known AI brand in the title has endorsed the project. In this case, the name was a lure.<\/p>\n<p>Never treat comments, profit screenshots, or repeated near-identical videos as independent audit evidence.<\/p>\n<p>If a guide says you must deposit substantial ETH before you can see whether a strategy works, the claimed demonstration is not a safe test.<\/p>\n<div id=\"mwtad2682264131\" class=\"gas_fallback-ad_381392-ad_309685-placement_406664\" style=\"margin-top: 50px;margin-bottom: 50px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"2944237110\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2>Why a Clean-Looking Source File Is Not Enough<\/h2>\n<p>Readers who know some programming may inspect the pasted source and feel reassured when they find no obvious transfer to an attacker.<\/p>\n<p>That inspection is useful only if the tool deploys the same source. TRM&#8217;s analyzed compiler did not.<\/p>\n<p>The site showed one thing in the editor and sent a different compiled contract to the blockchain. The mismatch happened after the source was pasted.<\/p>\n<p>A victim could therefore make a careful decision about the visible text and still authorize a transaction based on the wrong premise.<\/p>\n<p>Independent compilation and bytecode verification address that gap. They require technical skill and a development environment you selected yourself.<\/p>\n<p>If a tutorial forbids or discourages such checks, there is no safe reason to use it with real funds.<\/p>\n<div id=\"mwtad2285904485\" class=\"gas_fallback-ad_381392-ad_309685-placement_406665\" style=\"margin-top: 50px;margin-bottom: 50px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"2944237110\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2>What the On-Chain Numbers Do and Do Not Prove<\/h2>\n<p>TRM traced a specific set of funded contracts and recipient addresses. That is stronger evidence than counting angry comments under a video.<\/p>\n<p>The traced transactions support a documented loss within the analyzed campaign. They do not establish the identities of every person behind it.<\/p>\n<p>Likewise, the reported 224 wallets are not a count of every viewer deceived. Many people may have watched without sending funds.<\/p>\n<p>Some videos may have been removed or replaced since the analysis. A new title or channel can reuse the same kind of fake compiler.<\/p>\n<p>Focus on the behavior rather than a single video URL: an unverifiable tool receives the source, then asks you to deploy and fund a contract.<\/p>\n<p>The name of the AI assistant can change too. TRM observed older versions using ChatGPT language before Claude became the hook.<\/p>\n<p>No brand name in a video title can certify an on-chain contract. The independently verified deployment is the part that matters.<\/p>\n<p>If you cannot establish what bytecode a contract contains, do not use a live wallet as the testing environment.<\/p>\n<h2>What to Do if You Have Fallen Victim to This Scam<\/h2>\n<ol>\n<li><strong>Stop funding the contract.<\/strong> Do not follow a \u201cgas liquidity\u201d or reset instruction. In the analyzed case, that message was designed to produce another deposit.<\/li>\n<li><strong>Preserve transaction details.<\/strong> Save the contract address, transaction hashes, tutorial URL, guide link, timestamps, and any messages from the operator.<\/li>\n<li><strong>Secure the wallet according to your actual exposure.<\/strong> If you entered a recovery phrase anywhere, move remaining assets to a fresh wallet created safely. If you did not, avoid assuming the seed was stolen.<\/li>\n<li><strong>Review connected sites and approvals.<\/strong> This campaign did not rely on malicious approvals, but a separate site in your path could. Revoke permissions you do not recognize.<\/li>\n<li><strong>Report the video and site.<\/strong> Use the platform&#8217;s abuse tools and the relevant cybercrime authority. Share the addresses and hashes without posting your seed phrase.<\/li>\n<li><strong>Check for downloads.<\/strong> The described campaign centered on a malicious compiler, not necessarily installed malware. If you downloaded software, scan with Malwarebytes and remove unknown extensions.<\/li>\n<li><strong>Beware recovery impostors.<\/strong> A stranger promising to reverse an on-chain transfer for an upfront fee may be another scammer.<\/li>\n<\/ol>\n<p>An ad blocker such as AdGuard may help with malicious advertisements, but it would not detect an operator-controlled compiler reached through a voluntarily chosen tutorial.<\/p>\n<p>Some on-chain losses cannot be reversed. Reporting still matters because it preserves evidence and may help investigators connect related addresses.<\/p>\n<h2>Frequently Asked Questions<\/h2>\n<h3>Is Claude itself involved in this crypto bot scam?<\/h3>\n<p>TRM found no Anthropic product or AI functionality in the examined contracts or compiler. Claude&#8217;s name was used to market the fraudulent tutorial.<\/p>\n<h3>Why did the wallet not warn before the funds moved?<\/h3>\n<p>The victim deployed and funded a contract they controlled. The trap was substituted bytecode, not the usual spoofed wallet connection or hostile approval.<\/p>\n<h3>Were the videos from one creator?<\/h3>\n<p>They appeared across separate channels. Similar scripts, figures, and guides led TRM to assess them as a likely coordinated cluster.<\/p>\n<h3>Did the code displayed on screen contain the theft logic?<\/h3>\n<p>In the analyzed compiler variant, no. The displayed source was a clean decoy, while different code was compiled and deployed.<\/p>\n<h3>Can adding more ETH fix the bot after an error?<\/h3>\n<p>Do not do it. TRM identified one technical-sounding error as a fabricated pretext for another deposit after funds were already diverted.<\/p>\n<h3>How much did the documented cluster take?<\/h3>\n<p>TRM traced 274.60 ETH from 224 victim wallets, valued at about $517,205 at the time of those transfers. That is a cluster total, not a universal estimate.<\/p>\n<h2>The Bottom Line<\/h2>\n<p>This AI crypto arbitrage bot scam hid behind an educational video and a fake compiler. The wallet performed genuine actions, but the deployed contract was not the promised bot.<\/p>\n<p>Do not fund a contract from an unfamiliar tutorial tool. Verify the development environment and deployed code independently, or walk away.<\/p>\n<div id=\"mwtad1682285691\" class=\"gas_fallback-ad_176819-ad_309685-placement_406666\" style=\"margin-top: 50px;margin-bottom: 50px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"8386082122\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>A video promises to show you how to build a crypto arbitrage bot with Claude. The instructions look approachable, even if you have never written a contract. Before funding anything, pay attention to the tool &#8230; <\/p>\n<p class=\"read-more-container\"><a title=\"AI Crypto Arbitrage Bot Scam: Fake Claude Tutorials That Drain ETH Wallets\" class=\"read-more button\" href=\"https:\/\/malwaretips.com\/blogs\/ai-crypto-arbitrage-bot-scam-fake-claude-tutorials\/#more-420269\" aria-label=\"Read more about AI Crypto Arbitrage Bot Scam: Fake Claude Tutorials That Drain ETH Wallets\">Read more<\/a><\/p>\n","protected":false},"author":51,"featured_media":420270,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[49],"tags":[],"class_list":["post-420269","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scam-reports","masonry-post","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/420269","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/users\/51"}],"replies":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/comments?post=420269"}],"version-history":[{"count":1,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/420269\/revisions"}],"predecessor-version":[{"id":420272,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/420269\/revisions\/420272"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/media\/420270"}],"wp:attachment":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/media?parent=420269"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/categories?post=420269"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/tags?post=420269"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}