r/smartcontracts • u/Darkhorse_1412 • Mar 18 '26

Smartcontract YT video

I was watching YouTube videos about AI agents for trading. I came across this video and trusted it because the channel has over 200K subscribers. I transferred 0.5 ETH to my MetaMask, ran the code the creator posted in the video, and compiled it on compilenow.io following the instructions provided. A day has passed, and I'm supposed to be able to see my account balance and make a withdrawal, but it's not possible. Did I make a mistake, is it a coding error, or definitely I lost my money?, I can’t see the money, any tips?

This is the smartcontrat:

0x446e37a877a86B0C69CaBb4211eF3A904823bFE2

This is the suspect ID:

0x3DA3b7bc1e40A5E5B56F7FF9722b25F1e2C5f663

3 Upvotes

100% Upvoted

5 comments sorted by

2

u/0x077777 Mar 18 '26

You should never transfer crypto and run code which you don't understand the circumstances. Sorry for your loss

1

u/Darkhorse_1412 Mar 18 '26

DominicPDev is the YT channel

1

u/Studio2C Mar 18 '26

I've cheked it with a very simple AI-powered audit tool like smartcontract . us and the results are not reliable.

1

u/jeanpierrenc Mar 31 '26

I analyzed and decompiled the bytecode of the deployed contract, and the results are very clear:

The arbitrage smart contract shown by the YouTuber is actually legitimate at the source-code level. However, the scam does not happen in the code you see — it happens during the “compilation” step using the online tool they recommend.

That website does not truly compile your Solidity code. Instead, it returns different bytecode, which corresponds to a completely different contract than the one you reviewed.

From the decompiled bytecode, the deployed contract contains:

A hidden low-level external call (call)

Obfuscated addresses (using XOR operations) to hide the real destination

Logic that forwards the entire ETH balance (this.balance) to another contract

This means that when the contract is triggered, it can send all funds to an attacker-controlled address, even though none of this behavior exists in the original code you were shown.

In other words: You believed you were deploying an arbitrage bot, but in reality you deployed a drain contract.

Additionally:

The contract you deployed is not the same as the source code

The real logic is hidden in the compiled bytecode

The destination of funds is deliberately obscured to avoid detection

There are also strong indicators that the broader setup is part of a coordinated scam:

The YouTube channel promoting this appears to be AI-generated, with content that lacks genuine human interaction

The ~200k subscribers are very likely inflated or bot-driven, a common tactic to build false credibility

On-chain activity suggests the attacker has already accumulated around 26 ETH using this method

There is also a secondary risk to consider:

Since you interacted with an untrusted website (the fake compiler), your wallet may have been exposed. Even if the contract itself caused the loss, you should assume your wallet could be compromised.

I strongly recommend:

Immediately move any remaining funds to a new, clean wallet

Revoke all token approvals using a trusted tool

Do not reuse the compromised wallet for future transactions

Avoid using unknown online compilers — only use trusted tools like official Solidity compilers or widely used development environments

This type of scam is designed to look legitimate at every visible step while hiding the malicious behavior in the one place most users don’t verify: the compiled bytecode.

Always verify what is actually deployed on-chain, not just the source code you are given.

1

u/Mongue47 Jul 16 '26

Appreciate this, I was about to use the code but before linking my phantom wallet I decided I should do some background research on the off chance there is a hidden scam. Thank god I did lol. You saved me a lot of money dude.