The connect-wallet tell: fake AML checkers turn a compliance ritual into a drain

A crop of counterfeit crypto wallet-screening sites is promising to tell visitors whether an address is linked to suspicious activity, and then trying to trick them into handing over access to their funds, according to Malwarebytes ^[1]. That matters because the victims are self-selecting for caution: the people who go looking for an anti-money-laundering check are the people trying to protect themselves, and the scam dresses each step up as part of a normal security review ^[14].

The useful part of this write-up is that the tell is mechanical, not aesthetic. AML screening in crypto means checking whether an address has links to hacks, scams, sanctioned entities or other suspicious activity, based on its transaction history ^[3]. For a basic check, the service needs the public address and nothing else: no wallet connection, no approval, no signature ^[4]. Malwarebytes puts it plainly: if a checker asks you to connect your wallet rather than enter the public address, treat that as a warning sign ^[5]. That is a one-line rule an awareness programme can ship this week, because it does not depend on spotting a good forgery. And the forgeries are decent, with many sites impersonating the legitimate service AMLBot or trading under names such as "AML Check", copying the logo, layout and language ^[6].

The flow is short: pick your cryptocurrency, click Check Wallet, connect ^[7]. Connecting on its own does not move funds; what it does is reveal the public address, which the operators use to build a transaction aimed at that specific wallet and push it back for approval ^[8]. Knowing the address also lets them see the assets held there and size the request accordingly ^[10]. The objective throughout is a victim-signed transaction the victim does not understand and was not expecting ^[9].

Then comes the theatre. One version Malwarebytes reviewed runs a progress bar with lines such as "Checking wallet history..." and "Verifying compliance...", stalls on a fake error saying the wallet needs a small top-up to cover a fee, and on Retry replays the same animation before returning a reassuring "Clean, Low Risk" verdict and a downloadable report, whether or not any check happened ^[11][12].

Triage depends on how far someone got. Connected only: disconnect the site ^[15]. Approved token access: review token permissions and revoke the ones you do not recognise, using your wallet provider's approval checker if it has one ^[16]. Signed or confirmed something: check recent activity and move remaining funds to a new wallet ^[17]. Entered a recovery phrase or private key: treat the wallet as compromised and move assets to a new wallet with a new phrase ^[18]. Downloaded a file: do not open it, delete it, scan ^[19]. Speed matters because confirmed crypto transactions generally cannot be reversed ^[20].

Two things to watch. First, reuse: the same basic design and process has surfaced under several names and logos, which points to a shared template being rebranded rather than a single site to block ^[13]. Second, the second wave. Anyone who has already lost money should expect contact from people offering recovery for a fee, since recovery scams routinely target prior victims ^[21]. In the meantime, check the address bar carefully, particularly if you arrived via an ad, a social post, a message or a search result ^[22].