Attackers use AI-generated videos featuring credible crypto experts to create YouTube videos promoting trading scam and the deployment of smart contracts. These contracts, designed for trading bots, are infused with malicious code, with withdrawal functions that transfer funds to the attacker instead of the user.
Trading Scam Involving AI Influencers and Malicious Smart Contracts
On February 26, 2025, Gen Threat Labs issued a warning via X/Twitter post about a new trading scam. This scheme uses AI influencers to deceive victims into creating trading or arbitrage bots with malicious smart contracts. It is primarily spread through private YouTube videos, and victims lose their funds when attempting to withdraw, as the smart contracts are designed to siphon money to the attackers.
The entire trading scam revolves around the use of AI influencers, which are virtual personalities created using artificial intelligence technologies such as machine learning and natural language processing. These AI influencers are designed to appear as trustworthy figures in the crypto space, often portrayed as experts providing tutorials and guides. They promote the trading scam and creation of trading or arbitrage bots by instructing users to deploy specific smart contracts, making the promotions seem legitimate and appealing.
Trading bots are automated programs that execute trades based on predefined strategies. Arbitrage bots, on the other hand, specifically look for price discrepancies across different markets to profit from buying low and selling high. In this scam, victims are tricked into believing they can create profitable bots. However, the underlying smart contracts are malicious, ultimately leading to financial loss.
Technical Details of the YouTube Ads Trading Scam
A smart contract is a self-executing contract with the terms directly written into code, stored on a blockchain like Ethereum. They automate transactions and execute them as programmed, without intermediaries. This makes them popular for crypto applications such as trading, lending, and borrowing. The smart contracts in this scam are written in Solidity, the programming language for Ethereum, and are designed to interact with decentralized exchanges like Uniswap V2. Two specific contracts were identified:
- UniswapSlippageBot. Found at Pastebin Code, this contract is for mainnet use, importing Uniswap V2 libraries, and includes functions like start() (requiring 0.01 ETH to initiate trading) and withdrawal(), which withdraws profits to the contract creator.
- OneinchSlippageBot. Found at Slippage-Bot GitHub Page, this contract is similar, with functions for finding new contracts, starting trading, and withdrawing funds, also designed for mainnet use.
Both contracts include mempool-related functions (e.g., fetchMempoolData, getMempoolHeight) and interact with hardcoded addresses like WETH_CONTRACT_ADDRESS (“0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2”) and UNISWAP_CONTRACT_ADDRESS (“0x7a250d5630b4cf539739df2c5dacb4c659f2488d”).
The critical issue is the withdrawal() function. In a legitimate trading bot, this function should allow the user to withdraw their own funds. However, in these contracts, it is programmed to send funds to the contract creator, effectively stealing the victim’s money. This is a classic rug pull or honeypot scam, where the contract is designed to lock or misdirect funds, particularly when the withdrawal is attempted.
For example, the UniswapSlippageBot’s description states it “withdraws profits to contract creator,” and the OneinchSlippageBot has similar functionality. This means that when users try to withdraw, their funds are transferred to the attacker’s address, leaving them with nothing.
Another feature that adds credibility to this scam is that the videos provided in the post are private. I.e., they cannot be found on YouTube without a link. This creates a false impression of the uniqueness of the victim, but it has another explanation. The real reason the videos are hidden is to avoid instant exposure and blocking. Instead of a huge but short-term (one-time) catch, the attackers chose a more moderate but stable and relatively safe income.
How To Stay Safe?
Protecting yourself from this scam requires caution and awareness. Always verify the credibility of influencers promoting crypto opportunities. AI-generated content can be difficult to distinguish from real people, so check for verified accounts and cross-check information. If possible, have the smart contract code reviewed by a trusted expert or use analysis tools to detect malicious behavior.
Be especially cautious of contracts that send funds to hardcoded addresses or have withdrawal functions that primarily benefit the creator. Before investing, thoroughly research the project, platform, and any associated links. Avoid clicking on unknown URLs from ads or videos, particularly those promising quick profits. Finally, use well-known and reputable platforms for trading and bot creation, and steer clear of deploying contracts from unverified sources.
