YouTube 'MEV bot' tutorials, some AI-generated, tricked users into deploying drainer contracts; $900K+ taken
Ethereum users following YouTube 'MEV bot' tutorials
SentinelLABS reported in August 2025 that scammers use YouTube tutorials to get people to deploy a 'free' Ethereum arbitrage bot contract through Remix, fund it with ETH and press Start. Hidden code sends the ETH to an attacker wallet, and the top attacker address alone received 244.9 ETH (about $902,000). The videos ran on aged channels with manipulated comments, and SentinelLABS says several appear to be AI-generated. Versions of the scam have run since at least early 2024 and were described as ongoing.
Why this severity: $900K reported stolen, still active.
AI involvement
AI-made lures. SentinelLABS says several tutorial videos appear to be AI-generated from audio and visual tells, though the most successful one (about $902,000 taken) does not appear to be.
Check anyone who asks for money, a signature or a download on a second channel you already trust. A familiar face or voice on a call is no longer proof.
- Started
- Aug 5, 2025
- Closed
- Aug 5, 2025
- Chains
- Ethereum
- Reported stolen
- $900K
Indicators · never visit or send to these
- 0x2eEE3A0ed51AE22813050212E8D9Fa216bd51df4
- 0x7359EA6AA3343b3238171e76F97e6aA3cDB8d696
- 0x872528989c4D20349D0dB3Ca06751d83DC86D831
What to do now
- Stop sending funds to the contract; there is no withdrawal that will work for you.
- Report the video and channel, and keep the contract address and transaction IDs for a police report.
Stay safe
Am I affected?
If you deployed a 'MEV', arbitrage or trading bot contract from a YouTube video or a shared link and funded it, the ETH you sent is likely gone.
What to do now
- Stop sending funds to the contract; there is no withdrawal that will work for you.
- Report the video and channel, and keep the contract address and transaction IDs for a police report.
How to avoid this
- Free money-making bots shared in videos are scams, and the narrator may not even be a real person.
- Never deploy or fund code you cannot read and understand.
- Watch for unlisted videos, comment sections full of praise, and pressure to deposit a minimum amount.
Timeline 1
SentinelLABS' report (updated 5 August 2025) listed three attacker addresses and more than $900,000 taken.
Source
News & write-ups ›1
How this method works
Someone posing as support, a recruiter, a journalist or a friend talks you into revealing a seed phrase, installing malware or signing something. Read about social engineering and fake support →
Follow new drains and updates in your feed reader or Telegram RSS bot.