Scammers make victims build the drainers that empty their own wallets

[Lucius]

~snip~
The lesson here is: don't copy and run unknown code. Don't open unknown files. Don't trust people you don't know who want to help you get rich. They might be looking for a way to get rich off of you. Keep both eyes open at all times.

The sad part of this story is that the victims made and deployed the drainers that stole money from themselves.

This is at the same time incredibly ingenious, and on the other hand, for me personally, comical. If you can't steal something from someone, you can convince them in a very polite and simple way to hand it to you on a silver platter.

I'll just say that the conclusion of these kinds of stories is that there are a lot of lost people in the world who have a lot of money, and they are a supermarket for hackers. Now that they have AI as a tool, it's even easier for them to achieve their goal - and it won't stop, but these attacks will become more and more ingenious and frequent.

My advice to all those who do not understand the risks of the online world is to think very carefully about using social networks if they invest in cryptocurrencies.

[Alvin_talk]

Hmm......
Scammers really don't get tired, do they? The numerous methods scammers use to scam their victims in the crypto space is already becoming overwhelming. But do we relent to fight against these scams? The simple answer is NO. Moreover, we don't need to know every scam method that these criminals utilise. Just as OP has pointed out, all we need to do is to learn more about security and privacy and avoid opting in to offers from unknown or unverified sources, so that we become difficult target for the scammers.

Indeed, scam activities in the crypto space is inevitable but most are avoidable if we take our security practices seriously.

I feel another bad aspect of this is that these scammers can make a scam appear very legit so that the victim will have no reason to be suspicious of what he or she is doing.  When following a tutorial video online and you're basically doing everything they say step by step, at a stage you might genuinely think that you are just learning something technical and not realize that just a click on something you don't actually know might be giving the attacker access to your money.

Yeah, these scammer read human psychology so well. They figured out learners will definitely follow most instruction of the tutor, thus they capitalised on this singular weakness. I can't say people should always doubt their teachers because of this. But we have to be carefull of the kinds of tutorials we subscribe to. I believe even in the online space, we still have trusted individuals in every niche. A more practical approach would be to verify the authenticity of the program or tutorial you enrolled for before anything else.

[SquirrelJulietGarden]

I'll just say that the conclusion of these kinds of stories is that there are a lot of lost people in the world who have a lot of money, and they are a supermarket for hackers. Now that they have AI as a tool, it's even easier for them to achieve their goal - and it won't stop, but these attacks will become more and more ingenious and frequent.

AI has developed very speedily and AI tools now are powerful and efficient enough to support hackers, to make hacker jobs more easily while with other people, their lives become more dangerous with more risk of attacks, exploitation from hackers.

In the rise of the machines.

My advice to all those who do not understand the risks of the online world is to think very carefully about using social networks if they invest in cryptocurrencies.

The rise of machines, AIs and their support for hackers are considerable but in security and privacy, people must learn about most fundamentals but also most vital principles. If they can maintain their practice based on those most vital principles, they will be safe from AI threats.

In contrast, people who are careless with their practice will have to face with more risk and attacks in this AI era.

[Zigabel]

Yeah, these scammer read human psychology so well. They figured out learners will definitely follow most instruction of the tutor, thus they capitalised on this singular weakness. I can't say people should always doubt their teachers because of this. But we have to be carefull of the kinds of tutorials we subscribe to. I believe even in the online space, we still have trusted individuals in every niche. A more practical approach would be to verify the authenticity of the program or tutorial you enrolled for before anything else.

Most scammer can actually tell if they will be successful with a particular person through the conversation they engage in just before they proceed to scam that person, they have that intelligence and knows how to make psychological trails that will keep their victims hooked till they have accomplished that which they started.

I advise people most time to not even engage because that is where the whole thing begins at, if you don't engage enough to give the scammers clue to your weak spot, they will not be able to know how well to get you scammed as they wish to. Your engagement with them help them to gather the information they will be needing necessary for the scam they are about to unleash on you.

For every verified teachers, there are channels to check on reviews about them to confirm their authenticity, so it is important like you said, before subscribing to any online tutor, make sure to check them out on how trusted they can be and if they beginning to ask for too many sensitive information, or leading you to building things that could give third parties access, be very mindful to continuing with them.

[Pmalek]

We need to verify code and understand what we are approving before giving any program access to our funds.

In the AI era, this has become easier than ever. Most people can't do such verifications themselves simply because they don't have coding/programming skills and reading thousands of lines of code isn't going to change that. However, you can use an AI model, give it a simple prompt, and ask it to inspect the code and give you a detailed report or summary of what the code does. Do this with multiple brands just to be on the safe side. If all of them report that the code contains actions that should by no means be present, then don't use it.

[Lida93]

The lesson here is: don't copy and run unknown code. Don't open unknown files. Don't trust people you don't know who want to help you get rich. They might be looking for a way to get rich off of you. Keep both eyes open at all times.

Aside from this lesson.

If these bot creators are profitable and making money, they're not going to share it publicly. And they are going to make riches silently without even the need to interact to anybody.

Sad to say that they're good in convincing gullible victims and that's why they're eager to post it on youtube. I've searched with a keyword of "build ai bot for trading" and there's a bunch of these content creators with thousands of followers.

It just another story to remind people that are too eager for profit making to remember that those that claims to make you rich online do have family members and friends that ain't struggling in life, what makes you think you are exceptionally unique to be the person worth getting such information. The urge to make money has really made many people to loose their sense of reasoning to stop and think about certain offerings online by some strange dude who himself isn't even as rich as they claim but rather seeing you as a means to a fat wallet.

I believe some who are vouching them in the comment section are also themselves.

Yes.
What they do is create other accounts that acts like different persons that have had it worked for them. It's all done to make it look legit so the victims don't suspect but believe it to be true since others are speaking good about it.

[Proty]

This is  evidence that wallet may not be the the major security challenge, but how the user of the wallet actually utilise it. There are people that blindly trust what they see online without making further enquiries , especially when it involves making money. I believe these user just copied and ran a code they knew nothing about.
It is wrong to run a code that can communicate or interact with wallet without a proper understanding of how it works. If this code is designed to gain unauthorised access to a wallet the funds there can be tempered with and it will be impossible to recover it. Therefore, people needs to be very careful in running unknown code that can easily access there private keys.

[Mrbluntzy]

The lesson here is: don't copy and run unknown code. Don't open unknown files. Don't trust people you don't know who want to help you get rich. They might be looking for a way to get rich off of you. Keep both eyes open at all times.

Another important lesson to learn from this case is that, if by chance one sees a similar kind of thing and wants to check it out, the person should never test-run it on their main laptop, desktop or phone, but instead use a secondary laptop/sandbox machine that is primarily set aside for test running suspicious softwares and code like this. People should learn to treat every software or code that they get from strangers as to be untrustworthy until they have test run it on a seperate device and has confirmed that it is completely safe to use.

For someone who is extremely conscious with using programing code that they get from a strangers, after the person must have built the app/bot using what ever code they collected from that stranger on YouTube, the next thing the person would have done is to use a fresh wallet that they just deposited small funds to test it. But the mistake they made was to launch the code on their main device and probably also connected their main wallets to the bot, such a dumb thing to do.

[Findingnemo]

Another incident that reminds us of the basic motto of Bitcoin - "Don't trust, just verify".

To be honest, even I do that, copy whatever the code they have given but never for any crypto related thing, just to expereint random tools like video editing, gaming and lot other productivity related codes and if went wrong it just steal our data but I am smart enough to keep those things in a different device which don't have any files at all, just modded games alone.

[JoyMarsha]

For those whose eyes are on making money by any means, they end up getting scammed into things they shouldn't do or trust.

These crypto trading bots made by AI are becoming what the scammers are using to scam people. If I should advice, people should stay off any crypto trading bot they learn from any social media because that's the way they lured in losing their crypto

[Brahmahatyaa]

The lesson here is: don't copy and run unknown code. Don't open unknown files. Don't trust people you don't know who want to help you get rich. They might be looking for a way to get rich off of you. Keep both eyes open at all times.

I would like to ask one thing that may also be related to this case.

If someone uses an automated trading bot on a testnet network and downloads another person's bot script from github, could that script potentially compromise or drain funds from their personal wallet?
A friend of mine has been experiencing this issue. Every time he funds his wallet again, all of his assets end up being drained. This happens even when he creates and uses a completely new wallet. He got the bot script from a friend who sent it to him via telegram.

[hd49728]

In the AI era, this has become easier than ever. Most people can't do such verifications themselves simply because they don't have coding/programming skills and reading thousands of lines of code isn't going to change that. However, you can use an AI model, give it a simple prompt, and ask it to inspect the code and give you a detailed report or summary of what the code does. Do this with multiple brands just to be on the safe side. If all of them report that the code contains actions that should by no means be present, then don't use it.

It can be technical and people mostly don't do that but if people don't quickly trust strange links and act immediately with given guides, they will not be scammed. They simply need to check with official site, check information and compare them together from two sources, then realize something wrong.

It's simple and easy.

People who skip this step will become most favorite potential victims of scammers and hackers.

If people can not Verify Electrum wallet, they can apply some advice in The paranoid user's security guide for using Electrum safely. Doing some of these steps can help them having better practice and security, even not perfect, it's better.

Another incident that reminds us of the basic motto of Bitcoin - "Don't trust, just verify".

They need to at least verify the information, double check it with official websites. If skip the double check step, they accept very high risk to be scammed someday.

[Findingnemo]

Another incident that reminds us of the basic motto of Bitcoin - "Don't trust, just verify".

They need to at least verify the information, double check it with official websites. If skip the double check step, they accept very high risk to be scammed someday.

In this particular incident, the victims couldn't have anything to verify because we need to know what we are doing when we are dealing with codes or just better stick with the existing ones that is trusted by others. But just a random person teaching them to create on their own kind of inspired them even though they don't know what they are doing and end up learning an expensive lesson.

[Felicity_Tide]

The lesson here is: don't copy and run unknown code. Don't open unknown files. Don't trust people you don't know who want to help you get rich. They might be looking for a way to get rich off of you. Keep both eyes open at all times.

The sad part of this story is that the victims made and deployed the drainers that stole money from themselves. 

One thing I have come to understand is that the world hasn't gotten generous to such an extent where people would willingly share a trading bot that is 100% sufficient and reliable in making money. Money making opportunities are often kept private, rather than being left lying around in some random YouTube tutorial. My major concern is how people end up putting the money they've earned at risk just because they want to make more money. I won't dispute the fact that a lot of people actually lack a sceptical sense_{(not sure if that's an actual word)}, which makes them want to try everything that looks like a money making opportunity. But their inability to actually protect what they already have makes the whole thing even more disappointing. From the looks of things, we're yet to see the craziest level of social engineering attacks... It keeps getting sophisticated.

[salad daging]

This reminds me of some time ago when it was crowded at X about trading bots for Polymarket, some influencers who tick Blue have many followers often share trading profits on the bot in just a short time, there are those who one week to one month can make tens of thousands of dollars just because they rely on the trading bot they make.

These influencers often mark up profits, often share the coding via Github that they create, all you have to do is copy and apply it to the Cloud AI that they have suggested.

What I said was probably part of this kind of scam, we never really know about it, because I didn't verify the code myself because I don't have any expertise even though I use AI.

The point is not to trust people on the internet too much, if you don't know them closely then they are doing fraud.

[Hamza2424]

The lesson here is: don't copy and run unknown code. Don't open unknown files. Don't trust people you don't know who want to help you get rich. They might be looking for a way to get rich off of you. Keep both eyes open at all times.

The sad part of this story is that the victims made and deployed the drainers that stole money from themselves.

The bot even had a limit, it waits until they deposit more than 0.05 ETH, and every time a person, after installing the bot and connecting it with their wallet, hits withdraw and other operations, the money goes directly into the scammer's wallet.

This whole case is a lesson for developers who just started to use AI and watch tutorials without thinking about the code, files and links. I usually give these assets to AI and ask it to check if there is any backdoor, and ChatGPT and Claude could easily inspect them and guide us on how to use them properly.

[IjawMan]

We need to verify code and understand what we are approving before giving any program access to our funds.

In the AI era, this has become easier than ever. Most people can't do such verifications themselves simply because they don't have coding/programming skills and reading thousands of lines of code isn't going to change that. However, you can use an AI model, give it a simple prompt, and ask it to inspect the code and give you a detailed report or summary of what the code does. Do this with multiple brands just to be on the safe side. If all of them report that the code contains actions that should by no means be present, then don't use it.

Like the casinos term and conditions, how many gamblers read that before clicking on agree. With that do you really trust that people will be willing to spend that long time to be reading codes specifically for those that have no coding knowledge or any tech savvy knowledge.

How many persons can properly use the AI models not to mention optimizing it against phishing and scams threat. With the rate Ai powered scams are gaining momentum it is now a necessity for every online client to learn about how to use Ai for defense and detection of possible scam flags.

[promise444c5]

The lesson here is: don't copy and run unknown code. Don't open unknown files. Don't trust people you don't know who want to help you get rich. They might be looking for a way to get rich off of you. Keep both eyes open at all times.

I would like to ask one thing that may also be related to this case.

If someone uses an automated trading bot on a testnet network and downloads another person's bot script from github, could that script potentially compromise or drain funds from their personal wallet?
A friend of mine has been experiencing this issue. Every time he funds his wallet again, all of his assets end up being drained. This happens even when he creates and uses a completely new wallet. He got the bot script from a friend who sent it to him via telegram.

Yeah.. but it can be indirect. The script can just be used as a means of inviting a malware on your PC a, this won’t stop the script from doing its job perfectly, just that it’s doing/ already did an  extra dirty job in background.

The malware may eventually works in background too without spooking any logged in users or it’s  just replaces some stuffs including the wallet, inject malicious code or file to the wallet files dir, so that may explain why.. But I don’t get why he keeps funding.. is he daft?

[Cookdata]

I hate to see people start crypto and don't know about Bitcointalk. If they are here, maybe some of these scams will be known to them. It's sad that X has more crypto people now but understand nothing, they chased free money only to lose everything they have. I really wish this place will be for all as they used to say it was active for other coiners then but because the forum was strict , they all left that is why most announcements thread are not active.

If you look at this scam, I see most of the victims like amature because why create a trading bot built by AI and make large deposit when you can deposit small amount for test. Even if the bots isn't a copycat from a YouTuber on the internet, I wouldn't deposit large amount of money on an EVM, and it's AI supported. Some people lack self cautions but lesson learnt the hard way.

[Floxynice]

We need to verify code and understand what we are approving before giving any program access to our funds.

In the AI era, this has become easier than ever. Most people can't do such verifications themselves simply because they don't have coding/programming skills and reading thousands of lines of code isn't going to change that. However, you can use an AI model, give it a simple prompt, and ask it to inspect the code and give you a detailed report or summary of what the code does. Do this with multiple brands just to be on the safe side. If all of them report that the code contains actions that should by no means be present, then don't use it.

Like the casinos term and conditions, how many gamblers read that before clicking on agree. With that do you really trust that people will be willing to spend that long time to be reading codes specifically for those that have no coding knowledge or any tech savvy knowledge.

How many persons can properly use the AI models not to mention optimizing it against phishing and scams threat. With the rate Ai powered scams are gaining momentum it is now a necessity for every online client to learn about how to use Ai for defense and detection of possible scam flags.

hmbdofficial gave a very valid advice. I am one of those persons that do not have coding or programming skills. Because I understand my level of knowledge, I try as much as possible to avoid bots/codes I don't understand. I generally do not feel good about using codes I don’t understand.  However, just as was suggested by hmbdofficial, using AI models to detect if the code is authentic isn't a bad idea. It is good to go extra to verify anything that involves you risking your money.

There are some things people can do to protect themselves without having high coding or programming skills. A simple prompting can still save someone from scam.