Fake AML Checkers Are Draining Wallets

You get paid by a client you have never met. Or you buy USDT from a stranger on a P2P desk. A day later the thought arrives: what if that money is dirty, and the exchange freezes it the moment I deposit?

That worry is reasonable. It is also, as of this month, the hook for a scam.

On 19 August 2026 Malwarebytes published research on a cluster of websites posing as crypto AML checkers — the tools people use to see whether an address is tied to sanctions, stolen funds or a mixer. The pages look right. Clean layout, a chain selector, compliance wording, a "Check Wallet" button. Several copy the branding of AMLBot, a real screening provider. The domains named in the report include amlbot-clear[.]com, audittrust[.]shop, bitget-aml[.]com, search-aml[.]net and swapstoken[.]app.

Then comes the step that costs you everything. The site does not ask for the address you want to check. It asks you to connect your wallet.

What happens after you connect

Connecting hands the site your public address. That alone does not move funds. The next screen is what does.

The site builds a transaction and pushes it to your wallet for approval. On the page it is dressed up as part of the check: a progress bar creeping toward "verifying compliance", sometimes an error saying the scan failed and needs a small top-up to cover the network fee. You are annoyed by then, you want your result, you tap approve. What you actually signed was a token approval or a transfer that empties the balance.

The Malwarebytes researchers put the rule in one line. If an AML checker asks you to connect your wallet rather than enter a public address, treat that as a warning sign.

Some versions of the site do eventually show a result. It says clean. It always says clean, because nothing was ever checked.

Why the bait works

The fear being exploited is real, and it keeps getting more real.

On 7 August 2026 the US Treasury designated two digital-asset exchanges that Iran's Islamic Revolutionary Guard Corps relied on to move money, along with the operator of a network of front companies. Every action like that pushes fresh addresses onto the SDN list, and every compliance desk tightens its filters another notch. Anyone who deals with strangers on-chain has learned that a deposit can sit frozen for weeks while somebody asks where the coins came from.

So "check the address before you touch it" is good advice. Scammers read the same advice you do.

Building the fake is cheap. CoinDCX counted 1,212 websites impersonating its own site between 1 April 2024 and 5 January 2026. One template, a new domain, a new logo, repeat.

The rule that catches all of them

A real address screening needs one thing: the public address.

Not a wallet connection. Not a signature. Not a token approval. Not a fee paid up front. Not, ever, a seed phrase or private key.

That is a technical fact rather than a policy choice. Sanctions lists, mixer attribution and counterparty history are all read off public blockchain data. Anyone can look up any address without permission from whoever owns it, which is the whole point of a public ledger. If a service demands that you prove control of the wallet before it will tell you whether the wallet is risky, it is doing something other than screening.

Our own screening works the same way: paste an address, we read the chain, you get a risk result and a report you can hand to a bank. Run a check here — there is no connect button anywhere in the flow, because there is nothing to connect.

Other tells worth thirty seconds

• The domain. amlbot-clear[.]com is not amlbot.io. Compare the exact string, or reach the site from a link you saved yourself rather than from a search ad.
• Payment before result. Paid screening charges you for a report after showing you a preview. A "top-up to continue the scan" is not a pricing model.
• Instant perfection. A page that returns a spotless result in two seconds for every address is a graphic, not a check. Throw a known-bad address at it, such as a published Tornado Cash router. If that comes back clean, close the tab.
• Urgency in the copy. "Your wallet may be restricted." "Verify now to avoid freezing." Compliance tools do not write like that. Scams do.

If you already connected

Connecting on its own is usually survivable. Approving is not, though even then there is something to do.

Disconnect the site from your wallet. Then go through your existing token approvals and revoke anything you do not recognise — wallet apps and revocation tools list them by contract. Approvals sit there until revoked, which is exactly why drainers ask for one instead of a single transfer.

If you typed a seed phrase or private key anywhere, treat that wallet as gone. Move the balances to a fresh wallet now, largest first. Do not tidy up the old one and carry on using it.

Then look at where the funds went before you file anything with an exchange or the police. The destination address is on-chain, and it is evidence.

The numbers are moving the wrong way

Scam Sniffer counted $83.85 million lost to wallet-drainer phishing in 2025, across 106,106 victims. That was a good year by recent standards: 2024 saw $494 million and more than 332,000 wallets. The drop came from better wallet warnings and a few of the big drainer kits shutting down.

2026 has not held that line. In January alone, signature-phishing losses jumped 207% over December while the number of victims fell 11%. Fewer people, bigger hits. That is what happens when attackers stop spraying and start building bait for the people most likely to be holding real money — which includes anyone careful enough to go looking for an AML checker in the first place.

The lesson is annoying but small. A wallet check is a read operation. If a page treats it like a write, it is not a check.