CampaignPublished 5 Aug 2025

Smart Contract Scams | Ethereum Drainers Pose as Trading Bots to Steal Crypto

Source AlienVault OTX General

Description

A series of cryptocurrency scams have been uncovered where threat actors distribute malicious smart contracts disguised as trading bots to drain user wallets. The campaign has stolen over $900,000 US and employs multiple obfuscation techniques to conceal the attacker's wallet address. Leveraging aged YouTube accounts and curated comment sections, the scams create a false sense of legitimacy. The smart contracts, written in Solidity, use various methods to hide the attacker's Externally Owned Account. Distribution occurs through YouTube videos explaining the contracts as trading arbitrage bots, with some videos showing signs of being AI-generated. The most successful scam yielded approximately $902,000 US from a single attacker address.

Impact

For European organizations, especially those involved in cryptocurrency trading, blockchain development, or asset management, this scam poses a significant financial risk. Employees or clients interacting with these malicious smart contracts could suffer direct financial losses through wallet draining. Additionally, organizations that provide cryptocurrency services or wallets could face reputational damage if their users fall victim to these scams. The campaign's use of social media platforms like YouTube for distribution means that even less technically savvy users within organizations might be targeted. Given the increasing adoption of Ethereum and decentralized finance (DeFi) applications in Europe, the threat could undermine trust in blockchain technologies and disrupt business operations reliant on crypto assets. Furthermore, the obfuscation techniques complicate incident response and forensic investigations, potentially delaying mitigation and recovery efforts. The campaign also highlights the risk of AI-generated content being weaponized for social engineering, which could increase the scale and sophistication of such scams in the future.

Defensive guidance

1. Educate employees and users about the risks of interacting with unverified smart contracts, emphasizing caution with trading bots or arbitrage tools promoted on social media platforms. 2. Implement strict policies that prohibit the use of unvetted smart contracts or third-party trading bots within organizational wallets or systems. 3. Employ blockchain analytics tools to monitor wallet interactions and detect suspicious contract calls or fund transfers indicative of draining activity. 4. Use smart contract auditing services to verify the legitimacy and safety of any smart contracts before deployment or interaction. 5. Collaborate with social media platforms to report and request takedown of malicious videos and accounts promoting these scams. 6. Encourage the use of hardware wallets or multi-signature wallets that require multiple approvals, reducing the risk of single-point wallet draining. 7. Monitor threat intelligence feeds for the provided indicators of compromise (hashes and URLs) to detect potential exposure. 8. Develop incident response playbooks specific to blockchain-related scams to enable rapid containment and recovery. 9. Promote awareness about AI-generated content risks and verify the authenticity of online sources before trusting or acting on their information.

Indicators of compromise

URLs 1

https://codeshare.io/0bV94e

Hashes 6

2923cdf2caba3a92e0ea215d14343ce73e8f08a5
464aead7901305f689fe80326c83ffd7d0cd6a75
47d567e799f0403bcd4057bff50244125cac926a
9e71f537669e87ef10844266dc8d058a23199074
da1c5eb2b5cfc80173651a6ba552e1c110f06351
f0a34770f03428c8abc9e73df93263f10f8320b1

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 5 Aug 2025, 14:02 UTC

MITRE ATT&CK techniques7 from threat tags

Technical details

Indicators of compromise

URLs 1

Hashes 6

Community reviews

Related threats