Ethereum Arbitrage Bot Scam: A Thief in Disguise Uncovered

• The smart contract bot offers passive income from mempool arbitrage.
• The Ethereum arbitrage bot is a minefield of red flags.
• Scammers use hijacked X accounts.

The crypto market has entered a frenzy, with aggressive coin purchases taking center stage. FOMO is in full swing, and so are the shillers of quick passive gains.

One such example is the ChatGPT-based automated trading bot, which is noticeable under almost every post from major analysts or key opinion leaders’ accounts. DailyCoin has discovered that it’s another trap for those chasing quick profits.

Smart Contract Bot for Quick Passive Income

For months, crypto Twitter/X has been flooded with persistent posts linking to YouTube videos promoting an AI-driven smart contract bot as an easy way to generate passive income.

One such video, “How AI Helps Me Earn $2,400 in Ethereum Daily,” presented by a man named Jackson, explains how to set up a smart contract bot to earn through arbitrage trading.

The bot operates on a simple principle: it uses mempool arbitrage and front-running techniques on popular decentralized exchanges like Uniswap.

Put simply, the bot monitors the mempool—a sort of “waiting room” for transactions that have been initiated but not yet confirmed. It analyzes the mempool, selects certain transactions, and sets higher gas fees than the original ones. This ensures its transactions are processed first, followed immediately by a sell order.

In this process, the bot’s buy and sell actions “sandwich” the original transactions, profiting from the price difference or “slippage.”

Jackson, the video’s presenter, claims the bot was developed with assistance from ChatGPT and features pre-configured settings designed for ease of use. Users, he asserts, can start operating the bot with minimal adjustments and no prior coding experience.

Beginners only need to install a MetaMask wallet, deposit a minimum of 0.5 ETH, and connect it to an Ethereum Integrated Development Environment (IDE). Once the funds are deployed and the bot activated, it’s set to run for the chosen duration.

“Make sure you’re getting the code from the link in the video description to ensure it’s the most up-to-date version,” advises Jackson, warning that the crypto landscape is riddled with scammers.

In reality, Jackson’s offer may not be as innocent as it seems, with more red flags emerging upon closer scrutiny than one might initially expect.

Red Flag 1: Video Host Keeps Changing Names 

An unwritten rule says that when someone promises easy profits, you should first verify their credibility. 

His initial video is no longer active, and a Google search revealed no information about the mysterious Jackson.

However, a Google reverse image search revealed some interesting details from his promotional photos. I found a YouTube video where the same Jackson presents the same arbitrage bot, but this time under the name of Phillip.

I also examined Phillip’s photos, and a reverse image search led me to a third YouTube video. 

In this one, Jackson (or Phillip) again promotes the same bot, but this time, the video description is signed under another name—Kazz.

Typically, it’s unusual for legitimate trading bot creators to change their names frequently, so we saw this as a red flag. A cybersecurity expert I consulted confirmed these suspicions.

“Changing names is something scammers do a lot. They rebrand their operations to avoid getting caught and dodge any past complaints, making it harder for victims to track them down. It’s a tactic that lets them keep running their scams while still looking legit,” said cybersecurity expert Lukas M. 

Red Flag 2: Fake Ethereum IDE

After confirming that Jackson, Phillip, and Kazz are the same person, I examined the Ethereum Integrated Development Environment (IDE), which he encourages users to use to activate the trading bot. Major red flags were also found here.

In his YouTube videos, Jackson (or Phillip or Kazz) demonstrates how to set up a MetaMask wallet with the bot’s code via Remix.ec or Remixeth.ec environment. 

He strongly advises viewers to use the link to Remix from his video description and ensure it is the most up-to-date version. It quickly becomes clear that this is not without purpose.

Remix is the well-known name of Ethereum IDE. It is linked with the Ethereum project and is used for developing, deploying or managing Solidity-based smart contracts​. 

However, his official URL is remix.ethereum.org, which has nothing to do with remix.ec or remixeth.ec, the sites Jackson directs users to.

Although the interface of Remix.ec closely resembles the original Remix, it does not match the official, legitimate Remix URL, suggesting it could be a scam site targeting users unfamiliar with smart contract development.

Scam-detector, a website that provides a scam detection service by evaluating the legitimacy of online platforms, rates remixeth.ec a dismal trust score of 4.2 out of 100, signaling a lack of legitimacy and the presence of significant red flags.

Red Flag 3: The Code Comes with a Trick

If these findings haven’t convinced you yet, the trading bot’s code is the cherry on top.

According to people who used the bot and lost money, it is designed to merely glance at the mempool without performing any meaningful action and return the scammer’s address.

Additionally, its code ensures that all funds are transferred to the scammer’s account while the original bot smart contract user cannot withdraw them.

“I have learned that even with myself as the creator of the contract, the scammer can still withdraw the money. Which they have yet to do,” claims one smart contract scam victim.

According to him, the code specifies that all funds from the smart contract or bot creators would be sent to the wallet 0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2.

Onchain analytics platforms like Nansen and Arkham label the wallet as “Wrapped Ether,” which holds over $9.1 billion in its account at the time of writing. 

Another blockchain analyst, who also examined the smart contract scam, uncovered an additional wallet in the code: 0x7baed3e44115f5ecff54b35450124fa779c580e6. He said funds from victims lured by the offers were also redirected to this wallet.

Where Is the Money Going?

Upon checking this wallet, created in July 2024, it is clear that numerous incoming transfers have been made, most ranging from 0.1 ETH to 1 ETH. A significant portion of these came through the Uniswap exchange.

Although the wallet’s total holdings are currently just $4.6, over $12.26K worth of ETH (5.067 ETH) was withdrawn earlier in November, totaling over $30.42K worth of assets.

The largest transactions were sent to the wallets 0xd462604825124A8E8dB9A4CF6A907a645AA823b7 and 0x69563dc8C8Aa77604a8cf7B9aB3fa524c654C211. Both wallets, through intermediaries, directed tens of thousands of dollars worth of cryptocurrencies to accounts on Gate.io crypto exchange.

At least $1.1K worth of transactions were also directed to the wallet 0xEbA88149813BEc1cCcccFDb0daCEFaaa5DE94cB1, which accumulated holdings worth hundreds of millions. 

Some of these funds were transferred to deposit wallets on the Binance platform.

Hacks Legit Social Media Accounts

The amounts withdrawn from accounts associated with the Jackson-Philip-Kazz-promoted arbitrage bot scheme total in the millions. However, Jackson-Philip-Kazz is not the only figure behind this user scam operation.

On Crypto Twitter (X), the same passive income model is being promoted by another individual who operates across at least three different YouTube accounts under the “George” label.

Like Jackson-Philip-Kazz, various Georges present the same quick passive income model in their video clips, relying on an identical arbitrage bot scheme developed with ChatGPT.

However, these different Georges are now enticing investors with promises of not just $1,000 per day but also quick returns worth 6 ETH or 7 ETH within a week.

What’s even more concerning is that both figures behind these scam schemes are communicating not only from fake accounts on the X platform but also from legitimate accounts, which appear to have been hacked.

DailyCoin has identified several accounts tied to media channels in Africa and Mexico with tens of thousands of followers and a well-known cooking oil and margarine brand that has published Jackson’s or George’s videos from their X profiles. 

Some smart contract-related trading bot videos have already been removed from the hijacked X accounts. 

However, dozens of new ones continue to appear in their place. Neither Jackson-Philip-Kazz nor the Georges have slowed down.

Messages featuring their faces can still be found on Crypto Twitter (X), often under nearly every post from prominent analysts or KOLs.

“Hell is seeing this face in the replies every day,” commented Tangent Ventures co-founder Jason Choi this summer, referring to the aggressive tactics employed by the scammers. 

The crypto market is in a super bull cycle, driving explosive growth in asset values, investor profits, and FOMO. However, scammers are becoming increasingly active. Therefore, it’s important to remain vigilant.

Check out the red flags in Telegram Wallet:
Telegram Wallet: A Story of Buried Red Flags and Dubious Ties

Learn more about airdrop exploits: 
Airdrops Under Attack: Can Sybil Farmers Be Stopped?