Scammers Use Fake Crypto AML Checkers to Trick Users into Draining Wallets

Highlights

Cybersecurity researchers have uncovered deceptive websites posing as anti-money-laundering (AML) checkers that coax users into connecting wallets and approving transactions. These pages mimic legitimate services and display counterfeit scan progress and results. A real AML check only needs a public wallet address — never wallet connection or transaction approval. Scammers sometimes request a small fee or prompt token approvals to enable theft. Users should treat any AML service that asks to connect a wallet as suspicious and revoke permissions if already granted.

Sentiment Analysis

• 
  The overall sentiment is mixed to negative: the discovery highlights growing threats in the crypto ecosystem and emphasizes risk, but it also provides clear guidance for protective action. The tone combines concern about victims' potential losses with pragmatic advice on mitigation and remediation. Because the report warns of active scams and potential asset loss, the sentiment leans toward negative. The recommended progress bar shows moderate-high concern and urgency.
  
  
  

  
  70%
  

  
  
  
  

Article Text

Security researchers have identified a wave of fraudulent web services that present themselves as crypto-focused anti-money-laundering (AML) checkers but are engineered to trick users into compromising their own wallets. These malicious sites imitate legitimate platforms and use familiar branding or generic names such as "AML Check" to appear authentic. Their goal is to persuade crypto holders to connect their wallets and approve actions that could expose funds to theft.

Legitimate AML tools analyze a wallet's public transaction history to determine whether it has interacted with addresses tied to hacks, scams, sanctioned entities, or other suspicious activity. Crucially, such a check requires only the wallet's public address; neither connecting the wallet nor signing transactions is necessary to perform a basic review. Fraudulent sites exploit user unfamiliarity with these technical details by requesting a wallet connection and then simulating a scan with fabricated progress messages and results.

In observed cases, the fake services go further by requesting a nominal "fee" or prompting token approvals before returning a reassuring "Clean" or "Low Risk" outcome. These steps are designed to lull users into a false sense of security while enabling the attackers to create or execute transactions that the user mistakenly authorizes. While merely connecting a wallet does not directly transfer funds, it reveals the public address and allows attackers to craft convincing downstream requests that the victim might approve.

Analysis of multiple scams shows a recurring template: similar interfaces, repeated wording, and equivalent flows across different domains and brandings. This pattern suggests the use of a reusable scam kit that is easily rebranded and redeployed, increasing its reach. Experienced crypto users may recognize such tactics, but the persistence and variety of these campaigns mean that even careful users can be targeted by convincing clones or social-engineering tactics.

These incidents form part of a broader trend of phishing and cloned sites aimed at crypto users. Recent months have seen a number of high-profile impersonation campaigns, including cloned hardware-wallet vendor pages and fraudulent gaming platforms designed to harvest wallet credentials. Exchange operators have also reported thousands of lookalike domains impersonating their services, which indicates a sustained and organized effort to exploit the crypto community's trust.

To reduce risk, users should only provide a public wallet address when requesting an AML or reputational check and should be wary of any service that demands a wallet connection, transaction signature, or payment. If a user has already approved token access to a suspicious contract or dApp, they should promptly revoke those permissions using a reputable wallet interface or block explorer. Users who have entered private keys or recovery phrases into a dubious site should assume the wallet is compromised and move remaining assets to a new wallet created from a secure environment.

Acting quickly matters: crypto transactions generally cannot be reversed once confirmed, so timely action — such as revoking approvals and transferring funds — can mitigate losses. Ongoing vigilance, skepticism toward unexpected requests to connect wallets, and reliance on official, verifiable services will help users avoid falling victim to these fraudulent AML checkers. Security tools and community reporting also play a role in identifying and taking down malicious domains.

In summary, fake AML checkers present a credible and growing threat by abusing user trust and technical misunderstandings about what a wallet connection allows. Users should default to entering only public addresses for checks, scrutinize any request to connect or sign transactions, and follow prompt remediation steps if they suspect compromise.

Key Insights Table