MEV bot truffaldini disguise themselves behind ChatGPT: SlowMist's alarm

An old scam tactic in automated trading is making a comeback with a new disguise. Scammers are exploiting the wave of enthusiasm around artificial intelligence to revive MEV bot-based scams, renaming them to make it seem like they use the most popular AI technologies. According to blockchain security firm SlowMist, this fraudulent scheme is attracting more victims, even with a rebranding.

How ChatGPT becomes the perfect bait for MEV bots

In the past, these fraudulent bots were marketed as “Uniswap Arbitrage MEV Bot,” promising profits by automatically monitoring new tokens and price swings. Today, the method is the same, but the name has changed: “ChatGPT Arbitrage MEV Bot.” This rebranding is no coincidence. By adding the ChatGPT label to the name, scammers can attract attention and appear more credible to inexperienced traders.

Cybercriminals claim that the bot’s code was generated by ChatGPT, claiming this ensures the tool’s security. This social engineering tactic is especially effective in dispelling users’ suspicions about possible malicious intent hidden in the code.

The technical scheme: from MetaMask wallet to smart contract theft

The operational method is sophisticated but well-structured. Scammers lure users with the promise of an intelligent trading robot that could generate substantial gains simply by monitoring market movements on Ethereum. Victims are directed to create a MetaMask wallet and click on a fraudulent link that leads to the open-source platform Remix.

Once the malicious code is copied and the bot deployed on the blockchain, users are asked to “activate” the tool by depositing ETH into the smart contract. The promise is simple: the more funds you deposit, the higher the returns. When the confident trader clicks “start” to launch the system, something completely different happens: the ETH vanishes instantly.

The funds do not go into any trading algorithm. They are directly transferred to the scammer’s wallet via a backdoor embedded in the smart contract itself. From there, the stolen capital is quickly moved to cryptocurrency exchanges or temporary storage addresses, making tracking nearly impossible.

Over $130,000 stolen: the “broad net” strategy

SlowMist has traced at least three active scam addresses using these techniques. The figures are alarming: one address stole 30 ETH (worth over $78,000 at the time) from more than 100 victims since August. The other two addresses each siphoned 20 ETH (about $52,000) from 93 victims.

What’s striking is not just the total amount but the methodology. Scammers are not targeting large sums from individual victims. Instead, they adopt a “broad net” approach: stealing relatively small amounts from many people. This strategy is calculated: individual losses are so minimal that most victims decide that the legal and technical effort to recover the funds outweighs the amount stolen. As a result, criminals continue undisturbed, often simply renaming the scam with a new name once the previous one attracts too much attention.

Warning signs in promotional videos on YouTube

The internet, especially YouTube, is full of videos promoting these fraudulent MEV bots. Learning to recognize the signs of a scam has become essential. SlowMist identifies some key indicators: unsynchronized video and audio can be the first sign (the footage has been recycled from other sources), or clearly reused video material without modifications.

Another red flag is the comment section of scam videos: you’ll notice an unusually high number of praise and thank-you messages at the start, followed by later comments where users report being scammed. These subsequent comments, often deleted by scammers, reveal the true nature of the scheme.

Staying alert to these details can make the difference between protecting your funds and falling victim to these criminal operations, which, despite changing names and faces, remain fundamentally the same in how they operate.