Attackers are using YouTube videos that promise arbitrage-bot tutorials and code to direct victims to a counterfeit Remix development interface. The victims are encouraged to compile and deploy contracts, then deposit their own assets into them. The attackers registered ENS (Ethereum naming service) names containing "Uniswap" and used related addresses to appear as legitimate DeFi (decentralized finance) activity, leading victims to believe their bots were generating profits through Uniswap. The deposited funds were then transferred away by the attackers. On-chain investigator Specter said the operation appears to remain active, with a substantial portion of the stolen funds still held across two addresses.