The attacker forged Uniswap-related ENS names to implement an arbitrage bot scam

According to on-chain detective Specter, the attackers of this activity provided so-called arbitrage bot tutorials and code through YouTube videos, guiding victims to compile and deploy contracts using a counterfeit Remix development interface.

The attackers registered an ENS name containing "Uniswap," disguising the related address as a legitimate source of income for DeFi activities, leading victims to mistakenly believe that the deployed arbitrage bot was profiting through Uniswap. After victims injected their own assets into the contract, the funds were transferred away by the attackers. The attackers currently appear to still be active and hold a significant portion of the stolen funds across two addresses.