The YouTube MEV Bot Scam: How the "Remix Contract" Drains Your ETH

By Merunas Grincalaitis, founder of MEV DAO and a developer who builds MEV, sniping and trading bots on Ethereum. Last updated: October 2026.

TL;DR: The YouTube MEV bot scam is a tutorial that tells you to paste a "bot" contract into Remix, deploy it, send it ETH (usually "at least 0.5 ETH") and press start(). The contract never trades: it rebuilds a hidden attacker address and sends your whole balance there. SentinelLABS traced more than $900,000 to these contracts, including 244.9 ETH to a single attacker wallet. A real MEV bot can't run as a Remix contract you fund and forget, so if a video asks you to do that, it's this scam.

If you've searched mev bot scam youtube, you've probably just watched a calm, well-edited tutorial promising "passive income" from a front-running or arbitrage bot, and something felt off. Good instinct. I build MEV and sniping bots for a living, and this is the single most common scam I see in my messages. In this guide I'll take the scam apart step by step: how the video is built, what the contract actually does, how the address is hidden, and what to do if you already deployed it.

What is the YouTube MEV bot scam?

It's a malicious smart contract dressed up as a trading bot, distributed through YouTube tutorials. MEV (maximal extractable value) is the profit a bot makes by ordering transactions in a block, for example arbitrage between two exchanges, so "MEV bot" sounds technical and lucrative. That's the hook.

SentinelLABS' research (updated August 5, 2025) describes the campaign: videos explain the "bot", link to a page hosting Solidity code, and walk you through deploying it with Remix, a legitimate browser-based IDE for smart contracts. Variants have been running since at least early 2024 under many different accounts. Remix itself is fine; the scammers just use it because it lets a non-developer deploy a contract in a few clicks.

The same playbook shows up outside YouTube. A developer who goes by pkqs90 took apart a version promoted on Twitter as a bot "that makes me 5 ETH per week", and found the attacker's address had collected about 5 ETH.

How does the scam work, step by step?

Every version I've seen follows the same script:

The video. An aged YouTube account posts a tutorial: "How to create a passive income MEV bot on Ethereum." SentinelLABS found that several videos show signs of being AI-generated (unnatural voice, a narrator who only looks straight at the camera), and that the accounts are aged, some padded with playlists of other people's crypto news to look credible.
Social proof. The comments are full of people saying the bot made them money. SentinelLABS believes the creators use YouTube's comment management features to approve praise and filter out warnings.
The code link. The description links to an external site that hosts the "bot" contract code.
Deploy in Remix. You paste the code, compile it and deploy it from MetaMask. This part is harmless on its own: deploying a contract doesn't reveal your private key.
Fund it. The video tells you to send ETH to the new contract. SentinelLABS reports that each scam it analyzed told users to deposit a minimum of 0.5 ETH, supposedly to cover gas and leave enough for arbitrage profit.
Press start. You call start() or StartNative(). The contract computes the "router" address, which is really the attacker's wallet, and transfers the whole balance there. The transaction succeeds, and you may even see a reassuring log like "Running MEV action. This can take a while; please wait.."
The fallback. According to SentinelLABS, even if you never call start(), the contract includes a failover so the attacker can still withdraw what you sent.

Urgency is part of it too. One video SentinelLABS analyzed, posted on June 6, 2024, said the bot was free only until June 30 before going "private and licensed".

How do the contracts hide the attacker's address?

The scammer's address never appears as a readable 0x… string. The code builds it at runtime from innocent-looking pieces, surrounded by fake comments about "mempool scanning" and "liquidity". These are the techniques documented so far:

Technique	What the code looks like	Where it's documented
XOR of two constants	Two 32-byte constants with names like `DexRouter` and `factory` (or `apiKey`/`apiSignature`), combined with `address(uint160(uint256(a) ^ uint256(b)))`	SentinelLABS
String concatenation	Functions like `mempool()` and `callMempool()` glue hex fragments together and then parse them into an address	SentinelLABS; pkqs90's walkthrough
Large decimal to hex	A huge integer cast to `uint160`, which drops the high bytes and leaves an address	SentinelLABS
Decoy imports and addresses	Uniswap imports that are never called, plus the real WETH address (`0xc02a…6cc2`) so the code looks legitimate	SentinelLABS; pkqs90

In pkqs90's sample, the only two public functions, start() and withdrawal(), both sent the entire contract balance to the same rebuilt address. So "withdraw" in these contracts doesn't mean back to you.

The XOR version is the most sophisticated, and it's the one tied to the biggest haul: across several contracts it resolves to 0x872528989c4D20349D0dB3Ca06751d83DC86D831, which SentinelLABS says received 244.9 ETH (about $902,000 at the time) from victims' contracts. You can see its history on Etherscan. Other addresses in the report took in 7.59 ETH and 4.19 ETH. CoinDesk's coverage puts the campaign's total at over $1 million.

Why can't a real MEV bot work like this?

Because the hard part of MEV happens off-chain, and this contract has no off-chain part. A real searcher bot watches pending transactions and new blocks, simulates opportunities, builds transactions and sends them to block builders, often as Flashbots bundles. The on-chain contract is only the execution piece. A contract sitting in Remix can't read the mempool, decide anything or act on its own; it just waits for someone to call it.

The economics don't work either. ethereum.org's MEV page says that for competitive opportunities like DEX arbitrage, searchers may pay 90% or more of their MEV revenue to validators, and that the well-known strategies "are unlikely to be profitable for new searchers." A copy-paste contract handed to thousands of YouTube viewers would have no edge at all. If you want to see what a real one involves, read how MEV bots make money on Ethereum.

How can you spot a scam contract before you fund it?

You don't need to be a Solidity expert. If any of these is true, don't deploy it:

It wants ETH sent to a contract you just deployed. Real bots keep capital in a wallet or use flash loans; they don't ask you to pre-fund a black box.
It's "free" because the creator is generous. Nobody gives away a profitable MEV strategy, for the reasons above (I cover what a legitimate bot purchase looks like in MEV bot for sale: what's real and what's a scam).
The code builds an address from numbers or string fragments. Search it for uint160, ^ (XOR), long hex constants or functions that only return numbers. A legitimate contract has no reason to hide where funds go.
Every function that moves ETH sends it to the same computed address, not to msg.sender or a stored owner you can see.
The comments are technobabble. "Scanning mempool for highest liquidity" means nothing in a contract that can't see the mempool.

If you're curious, you can unmask the destination without risking anything: deploy the code to Remix's in-browser "Remix VM" environment, which uses fake ETH, fund it and call start(), then look at where the balance went in the transaction details. Never do that step on mainnet or with a real wallet connected.

What should you do if you already deployed it or sent ETH?

Act quickly, but don't make it worse:

Don't send more ETH "to unlock" or "to pay gas for the withdrawal". That's a common second stage.
Don't call withdrawal() or other functions hoping to get funds back. In the documented versions they send the balance to the attacker. Once ETH has left the contract, it's gone to an address you don't control.
Check your wallet itself. Deploying and funding the contract doesn't leak your private key. But if you also downloaded software, ran a script or typed your seed phrase anywhere, treat the wallet as compromised and move what's left to a new one. My guide on how to rescue tokens from a compromised wallet covers the case where a sweeper bot is already watching it.
Record the evidence: the video URL, the code link, your deploy and funding transaction hashes, and the contract address.
Report it. Report the video to YouTube, and file a report with the FBI's IC3 if you're in the US (or your local police elsewhere).
Ignore "recovery" offers. People who reply to your posts promising to get the ETH back for an upfront fee are running the next scam. I explain how to tell real rescue work from recovery scams in rescuing tokens from a compromised wallet.

Frequently asked questions

Are MEV bots on YouTube legit?

The "deploy this contract in Remix and fund it" tutorials are not. SentinelLABS documented that these contracts send your ETH to a hidden attacker address, and real MEV bots don't work that way.

Can I get my ETH back from a fake MEV bot contract?

Usually not. Once the contract forwards the ETH to the attacker's wallet, only that wallet's owner can move it; report the theft and ignore anyone who asks for a fee to recover it.

How do I know if a smart contract is a scam?

Read where every payout goes. If the code builds an address from constants, numbers or string pieces, or every function sends the balance to the same computed address, don't fund it.

Is Remix safe to use?

Yes. Remix is a legitimate open-source IDE for smart contracts; the danger is the code you paste into it, not the tool.

Does deploying a scam contract compromise my wallet?

Deploying or funding it doesn't expose your private key, but you lose whatever you send. If you also ran downloaded software or shared your seed phrase, treat the wallet as compromised.

How can you tell if someone is a crypto scammer?

Look for guaranteed or effortless profits, pressure to act fast, requests to send funds to a contract or address you can't verify, and "support" that contacts you first. Each of those is a red flag on its own.

Related guides

If you want an actual bot, the honest options are a tool you understand or code you own. I build custom Ethereum MEV bots for clients, and at MEV DAO we run a Flashbots sniper bot you can try free for 3 days. If someone sent you a "bot" contract and you want a second pair of eyes before you fund it, message me on Telegram.