Scammers make victims build the drainers that empty their own wallets

[TastyChillySauce00]

Back then people were pasting random code from internet into their computer's terminal, now people are pasting random smart contract code and deploy it without understanding what it did and what is the risk, problem as old as tale, generally speaking if you don't know what the code is doing, you should at least ask the AI what the code is doing and get an explanation, or never paste it at all.

People honestly seems like they don't really care if they are losing money otherwise they would at least think twice about doing it and be doubtful. On the other hand, didn't Claude or any AI in that matter give precaution that the contract code might be malicious? Claude gives warning whenever it audited a contract code, I bet it gives the same warning with this kind of dangerous prompt but might be ignored.

[taufik123]

There are many X accounts that share this kind of thing, building trading bots with AI, building LP Farming Bots and others that rely on AI and claim that they can make more profits in the instant way that the Bot runs.
Seeing how this fact you shared made me think, it is very easy for scammers to trick ordinary users into being interested and using codes that they don't even know what the code is embedded.

I am sharing this to show how dangerous it is to run code you don't understand and how trusting unknown people on the internet can be dangerous, especially those who claim they want to help you make money.

I've always been aware of my own security and really don't trust random people, not even trust your friends who suddenly share an unknown link or program or other investment invitation.

The lesson here is: don't copy and run unknown code. Don't open unknown files. Don't trust people you don't know who want to help you get rich. They might be looking for a way to get rich off of you. Keep both eyes open at all times.

The sad part of this story is that the victims made and deployed the drainers that stole money from themselves.
Source:
https://x.com/wyckoffweb/status/2101671671727898870

The first thing I need to do when I see this kind of shared code or application etc., I always check how the Virustotal scan results and usually if it is embedded with malicious code,
phishing and some kind of code that takes over and empties the user's wallet, it will be readable.

Then whether the code is Open Source or not and they or serious developers will share their code on GitHub and then all users can check if the code is safe or not,
because many developers can also see.
If the code is malicious, of course there will be a warning and may be reported.

[Brahmahatyaa]

.. But I don’t get why he keeps funding.. is he daft?

He had already deleted all of the files and believed the issue had been resolved. To verify this, he created a new wallet and funded it with less than €20. The funds remained safe at first, but once he began transferring a larger amount of assets to the new wallet, everything was drained again within seconds.

[Danish Ali]

The sad part of this story is that the victims made and deployed the drainers that stole money from themselves.

how can you sign a smart contract without looking at what you’re doing? they deployed it on their own computers.

followed some guy’s video, went straight to the “confirm” part, and just did it. ethereum wallets show you what contract you’re signing with and what function it’s calling before it lets you sign.

An attacker is always more interested in the victim's wallet than the victim themselves is. That is why victims let their guard down.

Yes, that's true, but I think the biggest problem with these scam videos is that they are teaching users that it is normal to click the "approve" popup, just as you would when you're watching a tutorial for some other piece of software and you're shown through the installation wizard. So, even victims who DO understand what code they're approving are still vulnerable because of habit.

I read similar article released by Sentinel Labs last year.

Good find. If this exact scam pattern was documented a year ago and still working now with 200+ wallets drained, that tells you YouTube isn't really doing much to catch or remove these tutorials even when researchers already flagged the method publicly.

[Pmalek]

..This is a high rate of scam, That redirect whatever someone have to their own wallet....That means they was a link sent to the victim which the victim clicked that redirects it funds in the wallet to the scam bot wallet...

No, there was no link sent to the victims. They weren't asked to download something from a malicious site either. They believed they were being taught how to build a trading bot from scratch as I explained in the OP. That bot, like any other software, needs code to run. Scammers gave them the code they needed to use. Believing that all was legitimate, the victims followed instructions and ended up digging their own graves. Instead of trading bots, they created drainers that emptied their own wallets.

[Somegory]

People should just stop looking for what's not lost online, if you need some AI tool or software find a official platform and pay for it, the time for free softwares online is over, always verify or pay dearly for your mistake..

Stop using torrents to find free softwares, hackers will gladly spend time upload free software with malwares and Trojans for long throat humans who don't want to pay for anything in their lives.

The most important advice for anyone who can't do without free tools and software is to take your coins as far away as you can from your computers into a cold storage instead, and keep your recovery seeds away from your computers.

[FinneysTrueVision]

ethereum wallets show you what contract you’re signing with and what function it’s calling before it lets you sign.

Not all smart contracts have decodable metadata that can be interpreted by wallets. In those situations, the wallet will just show you the raw hexadecimal data. The wallet usually displays a warning when you are blind signing, and if it is a good wallet, it should also perform a simulation showing you what is about to happen. This is very helpful in preventing theft, but not every wallet has the latest security features available.

[boyptc]

It just another story to remind people that are too eager for profit making to remember that those that claims to make you rich online do have family members and friends that ain't struggling in life, what makes you think you are exceptionally unique to be the person worth getting such information. The urge to make money has really made many people to loose their sense of reasoning to stop and think about certain offerings online by some strange dude who himself isn't even as rich as they claim but rather seeing you as a means to a fat wallet.

These days are hard, and that's why people are so desperate that they're going to take the bait that's made by these scammers. They're using their weaknesses and tough situation for them to fall for what's set up for them.

I don't want to blame these victims but, they should know that making money online or even in hard labor isn't easy. These bots and tutorials make it look easy and so they believe.

They have to verify each of what they see and the usual tip about too good to be true, they're not true.

Yes.
What they do is create other accounts that acts like different persons that have had it worked for them. It's all done to make it look legit so the victims don't suspect but believe it to be true since others are speaking good about it.

They create their own trolls and fake reviews.

[promise444c5]

.. But I don’t get why he keeps funding.. is he daft?

He had already deleted all of the files and believed the issue had been resolved. To verify this, he created a new wallet and funded it with less than €20. The funds remained safe at first, but once he began transferring a larger amount of assets to the new wallet, everything was drained again within seconds.

Deleted as in wipe the entire OS files/ cleared the entire partition or he only deleted some files like the wallet & it files before installing another one?  If he only deleted the wallet and it’s file, he’s just assuming not “believing” that everything is fine and that’s quite a dumb thing to do especially if you are dealing with any financial related stuff..


Although there are different ways to tackle different causes, in his own case… If I were him, I would only back up the files I can inspect to the cloud if they can’t be sacrificed for good Wipe or change the hard disk drive if it can be easily accessed and replaced.

Start afresh by reviewing those files again for the second time before pulling them back onto the PC.

[KingsDen]

As I always said, AI is a good technology to better our internet experience, and yet, bad players will continue to find ways to use them against us;

My blame on the victims is as follows;

• Why trust a total stranger to run their code in your system?
• Even if they have convinced them enough, why not run the codes on a separate device that do not house their funds. If you have  wallets installed in your phone or laptop, you should be weary of granting any software access to the device.
• Even if you want to take the risk and continue with the coding, they would have also verified the code by pasting it into an AI model to check if it's malicious.

The problem most people have is not being aware of the antics of these scammers. Op, thanks for sharing this one, I know they have other formats, but atleast, we are now aware of this one.

[Danish Ali]

Not all smart contracts have decodable metadata that can be interpreted by wallets. In those situations, the wallet will just show you the raw hexadecimal data.

Fair point, I was oversimplifying my argument, good catch.

The point I'm trying to make is that in the context of the scam where they're following a tutorial, seeing hex data or some blind-signing warning doesn't reduce the severity of the problem, it increases it, especially if they're being coached. The scammer will say "yeah that's normal, click confirm", and the victim has no means of validating that statement.

The wallet usually displays a warning when you are blind signing, and if it is a good wallet, it should also perform a simulation showing you what is about to happen.

imo it was a scam that could have been avoided with tx simulation, a feature in newer wallets (eg rabby) which shows the user in layman's terms what a tx is going to do before they sign it.

not everyone uses a wallet with simulation and i think it's an issue of adoption of simulation over "user education". someone could be as attentive as possible and would still fall victim to this kind of scam with a more basic wallet (eg plain metamask without any extensions)

[L E G E N D A R Y]

Most scammer can actually tell if they will be successful with a particular person through the conversation they engage in just before they proceed to scam that person, they have that intelligence and knows how to make psychological trails that will keep their victims hooked till they have accomplished that which they started.

I believe there more for scammers to learn from a person’s reactions than from the information they directly provide. Every individual are different in their own ways, and so the scammers often observes how an individual reacts and responds to urgency or promises as these mostly reveals which approach might actually work on them. And that’s why it’s crucial to be cautious even from the very first interaction and avoid saying or giving out more information than you’re supposed to, because the moment you start to allow your emotions to get the best of you, then it becomes easier for the scammer to know exactly which button to hit to get to you.

[EstherBtc]

Scammers learn behavioural patterns and know how to use vulnerable moments to their advantage. For every attack on bitcoin these scavengers will always want to benefit. This is the reason we need to be on guard at vulnerable moments like this.

Never execute code or deploy smart contracts you do not fully understand line by line.

[MainIbem]

A very helpful information although it relates with traders more cause it involves building a trading bot but everyone has to learn from this and never trust strangers online no matter how they claim to be generous, I know few friends that been drained through fake investments schemes so crypto investors need to be very careful. The best way to go about a coin like Bitcoin is self custody and not anyone asking you to stake your coin into a particular wallet for silly profits. Those scammers who pulled this stunt are very smart, using one of the best AI tool to trick people into draining themselves, super crazy.

[Junii]

Scammers have found a way to drain crypto wallets by tricking them into building the tool that ends up stealing from them. This particular case involves stealing Ethereum, but it doesn't matter which asset was stolen or how much of it. It could have also been targeting bitcoin or been created to do a different type of damage to a victim's system.

Bro it is so strange and interesting like people will think they are making an ai bot but actually they are handover there assets to scammers because what we heard is do not click on any suspicious link but in this type of cases definitely majority of people fell in traps of them and easily became there victims because no one will think from that angle i agree with your idea of if you do not understand the code do not run it and do not connect your wallet to it because in crypto world you are your own bank and one careless transaction can be enough to drain your wallet.   

[macson]

That scammer is definitely laughing his ass off at what those people did. He didn't build any traps; the victims built the trap themselves and willingly walked right into it. I don't know whether what you're saying comes from stupidity or greed. 

But those people only got what they brought on themselves. If they didn’t want quick profits and were willing to use a little bit of their brain to verify what they were doing, they could have avoided it. That scammer just took advantage of their greed and carelessness to make easy money, and he succeeded. How pathetic.

[Pmalek]

Another important lesson to learn from this case is that, if by chance one sees a similar kind of thing and wants to check it out, the person should never test-run it on their main laptop, desktop or phone, but instead use a secondary laptop/sandbox machine that is primarily set aside for test running suspicious softwares and code like this. People should learn to treat every software or code that they get from strangers as to be untrustworthy until they have test run it on a seperate device and has confirmed that it is completely safe to use.

You really don't have to run it. Remember, the tutorial creator on YouTube gave the people the code. Just paste the code or the file containing it into an AI model and ask it to inspect what it does. It's literally that easy. It would be a shame to run something unknown even on a secondary computer you don't care that much about if there is another step you can take first and run it through an AI first.