Crypto Scam Hides in Plain Sight via YouTube “Trading Bot” Videos, SentinelLABS Warns

A widespread crypto scam is exploiting dormant YouTube accounts to push fake trading bots that siphon funds via hidden smart contract backdoors, according to a SentinelLABS report published Tuesday.

The campaign, active since at least 2024, repurposes old YouTube channels that previously posted crypto tips or entertainment content. These accounts, says SentinelLABS researcher Alex Delamottea, now host videos (many AI-generated, of course) promoting a supposed Ethereum trading bot.

But what the user is actually doing is deploying a smart contract that discreetly embeds the scammer’s wallet address, disguised to look like a trading function. Once the user adds the funds… well, it’s all gone.

Related: SEC’s Liquid Staking Guidance Sparks Internal Clash Over Clarity

Highly-Engineered YouTube Scams

The videos themselves are engineered to bypass suspicion, posted on aged channels with high visibility. They even feature synthetic voiceovers and animations and are padded with fake testimonials in the comment section. 

Victims are typically coaxed into depositing a minimum of 0.5 ETH, around US$1.790 (AU$2.742) at current prices, under the pretext of covering gas fees and unlocking larger rewards. 

The scammer also deletes any critical feedback in the comments. But these videos are not exactly pushed through YouTube’s feed. In Delamottea’s words:

The video pushing this crypto scam is unlisted on YouTube, meaning that the video does not appear in search results or on the creator’s profile. The actor is likely distributing the video to victims through other social media platforms, which may include Telegram as the video description contains a link to the handle @janesolidity.

Alex Delamottea, SentinelLABS

Delamottea traced at least three wallets tied to the scheme: one with 244.9 ETH, another with 7.59 ETH, and a third with 4.19 ETH, altogether worth over US$939,000 (AU$1.4M).

The same wallet was found in multiple iterations of the malicious contracts, but other unique addresses have been used, making it difficult to determine whether a single group or multiple actors are behind the operation.

Delamottea noted that these accounts are likely either hijacked or purchased through Telegram and public marketplaces where old YouTube channels are openly traded.

Related: Galaxy CEO Says Treasury Growth Has Peaked — Just as Bitcoin ETFs See Massive Outflows