Fake Crypto AML Checker Sites Trick Users Into Draining Their Own Wallets

Security researchers say scam sites posing as compliance tools push victims to approve malicious wallet permissions

Malwarebytes has warned crypto users about fraudulent websites disguised as anti-money laundering, or AML, screening tools. These sites imitate the compliance checkers legitimate exchanges and platforms use to flag risky transactions. Instead, they exist to steal control of a victim’s wallet.

AML checkers are a normal part of crypto’s compliance landscape. Exchanges, custodians and some decentralized platforms use them to screen wallet addresses for links to sanctioned entities, hacks or illicit funds. Their legitimate purpose has made them a convincing disguise for scammers.

According to reports on the scheme, the fake sites ask visitors to connect their wallets before running a supposed risk check. That single request is the clearest warning sign. Genuine AML screening tools generally do not need direct wallet access to evaluate a public address. A public address alone is enough to check transaction history against blacklists.

Once a wallet is connected, victims are prompted to approve a transaction or grant a permission framed as part of the verification process. In reality, that approval can hand scammers control over specific tokens or, in more severe cases, broader spending rights. Funds can then be drained without any further action from the victim.

The tactic fits into a broader pattern of wallet-approval scams that have circulated across the crypto industry for years. Fraudsters have used fake NFT mints, phishing airdrops and cloned exchange login pages to harvest the same kind of permissions. Dressing the scam as a compliance or safety tool adds a layer of trust that pure phishing pages lack. Users who are already cautious about scams may feel reassured by a site that claims to be checking for risk, rather than posing one.

Malwarebytes’ warning arrives as AML and compliance tools have become more visible to everyday users. Retail platforms increasingly market address-screening features as a selling point. That visibility has apparently created an opening for scammers to build lookalike sites that trade on the same language and branding cues.

Security researchers reporting on the scheme have pointed to the connect-wallet prompt as the single most reliable tell. Any tool asking for wallet connection before displaying a risk score should be treated with suspicion, according to the warnings. Users are advised to check an address’s history through established, well-known screening services rather than unfamiliar links shared through social media, search ads or messaging apps.

Market Impact

The scheme does not target a specific token or protocol, so its direct effect on prices or trading volumes is likely to be limited. Its broader impact falls on user trust in compliance tooling itself, a category that legitimate exchanges and regulators increasingly promote as a safeguard.

If fake AML sites proliferate, platforms that rely on screening tools to reassure users may need to invest more in verification and public education. Wallet providers and browser-extension security tools may also face pressure to flag suspicious connection requests before approval screens appear.

The warning underscores a familiar lesson in crypto security: any prompt asking for wallet connection or transaction approval deserves scrutiny, regardless of how official the surrounding site appears.

Frequently Asked Questions

What is a fake AML crypto checker?

It is a website that mimics legitimate anti-money laundering screening tools but is designed to trick users into connecting wallets and approving malicious transactions.

Why did Malwarebytes issue this warning?

Malwarebytes identified fraudulent sites posing as compliance tools that request wallet permissions rather than performing genuine risk checks, putting user funds at risk.

How can users spot a fake AML checking site?

A request to connect a wallet before displaying results is a key warning sign, since legitimate screening tools typically only need a public wallet address to check transaction history.

What happens if a user connects their wallet to one of these sites?

Scammers can prompt the user to approve a transaction or permission that grants them access to tokens or broader spending rights, potentially draining the wallet.

Original source: AltcoinGordon

Syndicated coverage. Originally reported by altcoingordon.com.