MEV bot tutorial scam: the contract you deploy pays someone else

The tab with the Remix-looking compiler is open, the code from the video description is pasted in, and 1 ETH is sitting in your wallet as the “startup capital” the presenter asked for. On September 14, 2026, TRM Labs published a write-up of exactly this flow; most of the steps and figures below come from it.

To be clear about scope: this is not the arbitrage or grid strategy built into an exchange app. It is the kind where a YouTube video talks you through deploying a contract yourself. No platform, no API key — so it works nothing like the AI trading bot scam that drains you through a trade-only API key.

We would not spend time comparing the profit screenshots, the presenter’s confident tone or the hundreds of glowing comments. One sentence in the TRM piece does more work than any checklist:

“A professional-looking tutorial, familiar AI brand, active comment section, or readable source code does not establish that the smart contract ultimately deployed onchain is the code a user was shown.”

Five steps in the video, and where the trap is

The videos follow much the same order. For each step: what you see, what is happening behind it, and how to judge it.

1. Watch the video. The presenter says they have written a bot that arbitrages automatically and are giving it away. SentinelOne Labs, in a 2025 report, noted that “videos that distribute the scams show a considerable amount of effort focused on aging the YouTube accounts”. SentinelOne also noted that several of those videos appeared to be AI-generated. In the 2026 cases TRM tracked, the videos used AI-generated presenters and voices to look like different creators, and in one case TRM found nine nearly identical tutorials. Channel age and a friendly face tell you nothing.
2. Get the code from the description. In the videos SentinelOne looked at, “the video descriptions share a link to an external site that hosts the weaponized smart contract code.”
3. Paste it into a compiler and deploy. The 2025 batch would “explain how to deploy a smart contract on the Remix Solidity Compiler platform”. By 2026, TRM found the operators running their own Remix look-alike; in one variant, a background script throws your paste away. You may well have read every line of what you pasted; in that variant it was never used. Judge this step by the address bar. The Remix documentation says the IDE is located at app.remix.live. Go in from a bookmark you saved yourself, never from a video description.
4. Send ETH in as “startup capital”. SentinelOne put it plainly: the scam only works once the victim funds the new contract with ETH, and every scam in their sample asked for at least 0.5 ETH. In TRM’s 2026 data, “the median victim lost 1 ETH, consistent with instructions in the tutorials to provide 1 to 2 ETH in startup capital.” The amount moves from batch to batch. The instruction to put money in first does not.
5. Press Start. The videos “tell the victim to deploy the contract with a call like Start() or StartNative()”. In the contracts TRM examined, calling Start or Withdraw is what sends everything above 0.05 ETH away. The button you are most tempted to press — Withdraw, just to get the money back first — does the same thing here as Start.

Why can’t you spot the receiving address by reading the code? SentinelOne found that “the attacker-controlled wallet address is obfuscated in each smart contract we analyzed”, and “the XOR method is the most complex of the three examples”. Even if you write Solidity, the 2025 contracts would not show you where the money goes at a glance. With the 2026 variant TRM described, the code you read is not even the code onchain.

Why your wallet never warned you

This is the part people struggle with afterwards. Your wallet pops up warnings for dodgy sites and approval requests, and this time it said nothing from start to finish. TRM’s explanation: there was “no phishing link, spoofed domain, or malicious approval prompt”.

Every step you took looks ordinary to a wallet: deploy a contract, send ETH to that contract, call one of its functions. “User deploys a contract” and “user sends ETH” are normal things to do, so nothing gets flagged. Signature phishing at least needs you to sign an approval, which gives the wallet something to show you. Here there is no approval to catch. You deployed the contract; the recipient written inside it is the other side.

A silent wallet is not a safety signal.

One-click arbitrage versus how MEV actually works

The videos tend to say the bot “does MEV”. The ethereum.org developer docs (page last updated February 26, 2026) define it this way: “Maximal extractable value (MEV) refers to the maximum value that can be extracted from block production”.

The same page describes the people doing it: “Searchers run complex algorithms on blockchain data to detect profitable MEV opportunities”. It is a contested business, too — for competitive opportunities such as DEX arbitrage, “searchers may have to pay 90% or even more of their total MEV revenue in gas fees to the validator”.

What follows is our inference, not ethereum.org’s wording. Something that takes complex algorithms, a bidding war with other searchers and handing most of the revenue to validators when competition is stiff does not sit comfortably next to “copy some free code, put 1 ETH in, collect returns every day”. If someone had written an arbitrage program that reliably made a profit, filming it and giving it to strangers would be the strangest possible thing to do with it.

Same script, a 2025 cut and a 2026 cut

Put the two reports side by side and the steps barely change: deploy it yourself, fund it yourself, press Start. What 2026 adds is a self-hosted Remix look-alike and batches of near-identical tutorials posing as different creators.

• 2025 (SentinelOne). Deploy on Remix, code hosted on a site linked from the description, the attacker’s address hidden in obfuscated code, a minimum of 0.5 ETH per video. The report also notes that several of the videos appeared to be AI-generated. It counts deposits into these contracts at 244.9 ETH, “worth ~$902,000 US” at the time.
• 2026 (TRM). Sold as an AI-written arbitrage bot (TRM notes that earlier versions in 2025 also used an AI brand as the lure), with AI-generated hosts and voices posing as different creators, compiled on a self-hosted Remix look-alike that in one variant swaps out your code, 1 to 2 ETH asked. TRM counts 274.60 ETH (about USD 517,205 at the time) drained from 224 victims between February and August 2026, through 234 contracts the victims deployed and funded, with the money ending up in six shared collection addresses.

234 contracts and 224 victims are two different figures; reading the numbers, some people deployed more than once.

Nor is the comment section evidence. SentinelOne noted that “the YouTube video comments are overwhelmingly positive” and that “the actors are likely managing the YouTube comment section to delete any negative comments”.

Already deployed, already funded: what still helps

The most important thing first: if you have not called Start or Withdraw, don’t. In the contracts TRM examined, those two functions are what trigger the transfer. Not pressing them does not mean the ETH is recoverable; it just means you are not the one sending it off.

We found no reliable source describing a way to get funds back out of these contracts, and this page does not suggest any rescue steps.

• Don’t add more. No matter who tells you one more transfer will unlock a withdrawal, send nothing more to that contract or that address.
• Report the video and the channel. YouTube’s spam policy covers “promoting ‘get rich quick’ investment schemes”, and says: “If you find content that violates this policy, report it using these instructions”. Given TRM’s nine near-identical tutorials, the same material often goes up several times, so the channel is worth reporting as well as the single video.
• Keep evidence and report it. Save the video URL, the channel name, the contract address you deployed and your transaction history, then work through the first things to do after a scam.
• Watch for round two. If someone later reaches out offering to trace and recover your onchain funds, read crypto recovery service scams first.

If you are still watching and have not deployed anything, TRM’s advice is: “Users should deploy contracts only through tools they independently choose and can verify”. SentinelOne’s is shorter: “crypto traders are advised to avoid deploying code shilled through influencer videos or social media posts”. And if what you are holding is a token contract rather than a bot, the next entry is how to verify a token contract address before you copy it.

Frequently asked questions

I read the pasted code line by line and saw no strange address. Can it still go wrong?

Yes. In one variant TRM Labs documented in 2026, the Remix look-alike throws away the source you pasted in the background and deploys a different contract, so however carefully you read, you were not reading the code that runs. In the 2025 version SentinelOne Labs analysed, the attacker's address was obfuscated in every contract, the most complex method using XOR, so you would not spot where the money goes by eye.

The comments are full of people saying it works, some with screenshots. Doesn't that count for something?

No. SentinelOne found the comments under these videos overwhelmingly positive and judged that the operators were likely deleting negative ones. TRM lists an active comment section among the things that do not establish the deployed contract is the code you were shown. The comments are part of the video, not independent evidence.

My exchange app has arbitrage and grid bots too. Is that the same thing?

No. This entry is about YouTube videos that have you deploy a contract yourself and send ETH into it yourself, with no platform in between. Strategy tools built into an exchange are outside its scope. If someone wants you to hand an exchange API key to a third-party bot, that is a different entry: AI trading bot scams.