Fake crypto AML checkers used to drain user wallets

Cybersecurity researchers at Malwarebytes have identified a new scam involving fraudulent anti-money laundering (AML) screening websites designed to drain cryptocurrency wallets.

These fake sites often impersonate legitimate services like AMLBot or use generic names such as ‘AML Check.’ The scam works by prompting users to connect their cryptocurrency wallets to view a compliance report. While connecting a wallet only reveals the public address, it allows scammers to see the assets held within. This information is then used to craft a specific, malicious transaction sent to the victim.

Once the victim approves the unexpected transaction, the funds are transferred to the attackers. Researchers emphasize that genuine AML screening only requires a wallet’s public address for a lookup and should never require a user to connect a wallet, sign a transaction, or grant permissions.