AI Bot Course Scam Steals 274.60 ETH from 224 Victims

Scammers posing as offering AI-powered cryptocurrency trading bot courses have stolen 274.60 ether (ETH) worth approximately $517,205 from 224 victims through a novel method of tricking users into deploying malicious smart contracts directly from their wallets.

The scheme, reported by TRM Labs on September 14, involved victims being instructed to create and fund smart contracts themselves. Unlike traditional phishing wallet thefts, the scam required victims to deploy contracts and send funds through their own wallets. TRM Labs confirmed that 234 malicious contracts were deployed between February 12 and August 11, with a median theft amount of 1 ETH per victim.

The course promoted using Claude AI to build automated trading bots, showing step-by-step instructions for wallet creation, code copying, contract deployment, and fund input. The scam relied on tricking users into believing they were compiling legitimate code in Remix-like interfaces while secretly redirecting funds to operator-controlled addresses. When victims clicked 'Start' or 'Withdraw,' amounts exceeding 0.05 ETH were sent directly to the operators.

TRM Labs noted that no phishing links or malicious approval requests were involved, as users manually approved contract deployment and fund transfers themselves. The scam used fake error messages claiming trading had stopped and urging victims to add 50% more funds, while also employing misleading terms like 'gas nonces liquidity'—a fabricated concept not related to Ethereum—to reduce suspicion.

The video content, featuring AI-generated presenters in some cases, was posted by different creators but followed nearly identical scripts. The videos collectively garnered 314,740 views as of September 2026. Similar scams previously used ChatGPT as bait; this time Claude was featured.

Unlike previous schemes that involved centralized exchanges, the stolen funds were routed through decentralized finance services and blockchain bridges without passing through centralized platforms. The incident highlights how even when wallet connection warnings fail to trigger, direct fund transfers via deployed contracts can still lead to losses if users don't verify code reliability.