{"investigation":{"slug":"fake-crypto-aml-checker-sites","entity_name":"Fake Crypto AML Checker Sites","trust_score":0,"severity_base":null,"score_modifier":0,"confidence":0.88,"status":"published","content_type":"investigation","summary":"A widespread wallet-drainer campaign, identified by Malwarebytes researcher Stefan Dasic and independently corroborated by Decrypt, Cryptopolitan, and Security Boulevard in August 2026, operates through counterfeit anti-money laundering (AML) wallet-checking websites. These sites impersonate the legitimate service AMLBot and similar compliance tools, tricking users into connecting their crypto wallets and approving malicious token permissions rather than simply submitting a public address as genuine AML checks require. The same scam kit has been rebranded across numerous domains, indicating a coordinated and ongoing campaign.","sections":[{"content":"In August 2026, cybersecurity firm Malwarebytes published a threat-intelligence report authored by researcher Stefan Dasic documenting an active campaign using fake anti-money laundering (AML) wallet-checking websites to drain cryptocurrency wallets. The campaign was independently reported by Decrypt, Cryptopolitan, Security Boulevard, and HackRead during the same period. The sites exploit a specific trust dynamic: users who visit AML checkers are already security-conscious, and the scam weaponizes that caution by disguising every stage of the attack as a routine compliance step. Dasic noted that the same underlying scam kit had been rebranded under multiple names and logos, indicating that the template is being redistributed or resold to multiple threat actors operating simultaneously.","heading":"Campaign Overview","sources":[{"url":"https://www.malwarebytes.com/blog/threat-intel/2026/08/scammers-are-using-fake-crypto-aml-checkers-to-drain-your-wallet","name":"Scammers are using fake crypto AML checkers to drain your wallet — Malwarebytes","type":"research","credibility":1},{"url":"https://decrypt.co/376029/fake-crypto-aml-drain-users-wallets","name":"Fake Crypto AML Checkers Are Trying to Drain Users' Wallets — Decrypt","type":"news_article","credibility":2},{"url":"https://www.cryptopolitan.com/fake-crypto-aml-checkers-drain-wallets/","name":"Fake crypto AML checkers push users to approve wallet-draining transactions — Cryptopolitan","type":"news_article","credibility":2}],"severity":"critical"},{"content":"The primary impersonation target is AMLBot, a legitimate and commercially active cryptocurrency wallet-screening service. Fraudulent sites copy AMLBot's logo, layout, branding, and compliance-oriented language. Additional sites use generic names such as 'AML Check' to appear as independent compliance tools rather than direct clones. Security researchers at PCRisk documented numerous fake domains operating under these impersonation patterns, including: amlbot.seize[.]report, amlbot[.]sale, amlbotchecks[.]com, aml-safety[.]app, amlrobotsaveru[.]com, amlreport-app[.]com, amlpremium[.]top, amlbotchecking[.]com, aml-bot.co[.]com, aml-safety[.]one, amlnix[.]com, and amlbot[.]club. Additional domains flagged in reporting include amlbot-clear[.]com, audittrust[.]shop, bitget-aml[.]com, search-aml[.]net, and swapstoken[.]app. These domains are presented here as indicators of compromise for awareness purposes; they should not be visited. AMLBot itself is the victim of impersonation in this campaign — it is not a participant in or contributor to the fraudulent activity.","heading":"Impersonation Targets","sources":[{"url":"https://www.pcrisk.com/removal-guides/32520-fake-amlbot-website-scam","name":"Fake AMLBot Website Scam — PCRisk removal guide","type":"research","credibility":2},{"url":"https://www.pcrisk.com/removal-guides/33236-amlbot-crypto-checking-scam","name":"AMLBot Crypto Checking Scam — PCRisk removal guide","type":"research","credibility":2},{"url":"https://www.malwarebytes.com/blog/threat-intel/2026/08/scammers-are-using-fake-crypto-aml-checkers-to-drain-your-wallet","name":"Scammers are using fake crypto AML checkers to drain your wallet — Malwarebytes","type":"research","credibility":1}],"severity":"critical"},{"content":"Legitimate AML wallet screening requires only a public wallet address — no wallet connection, no transaction signing, and no token approvals. The fake sites deviate from this at the first step. According to Malwarebytes, the attack proceeds as follows: (1) A user visits a fraudulent site, selects a cryptocurrency, and clicks a 'Check Wallet' button. (2) The site prompts the user to connect their crypto wallet via a standard Web3 wallet-connection interface, which is not required for any genuine AML check. (3) Once connected, the wallet's public address and asset holdings become visible to the attacker. (4) The site displays a fabricated progress bar with messages such as 'Checking wallet history...' to simulate a real scan. (5) A fake error is returned, and the user is prompted to pay a small fee to retry — this fee serves both as a small direct theft and as a further legitimacy signal. (6) After any payment or continued interaction, the attacker crafts a custom drain transaction targeted at the specific holdings in the connected wallet and submits it for the victim's approval. (7) Approving the transaction — which the user believes is part of the compliance check — transfers tokens or NFTs to attacker-controlled addresses. Because blockchain transactions are irreversible, recovery of drained funds is not possible once approval is granted. Users who entered a seed phrase or private key into any such site should treat the wallet as fully compromised.","heading":"Attack Mechanics","sources":[{"url":"https://www.malwarebytes.com/blog/threat-intel/2026/08/scammers-are-using-fake-crypto-aml-checkers-to-drain-your-wallet","name":"Scammers are using fake crypto AML checkers to drain your wallet — Malwarebytes","type":"research","credibility":1},{"url":"https://www.cryptopolitan.com/fake-crypto-aml-checkers-drain-wallets/","name":"Fake crypto AML checkers push users to approve wallet-draining transactions — Cryptopolitan","type":"news_article","credibility":2},{"url":"https://decrypt.co/376029/fake-crypto-aml-drain-users-wallets","name":"Fake Crypto AML Checkers Are Trying to Drain Users' Wallets — Decrypt","type":"news_article","credibility":2}],"severity":"critical"},{"content":"The campaign is notable for inverting a normal trust signal. Users who seek out AML checkers are typically trying to verify the safety of a wallet — meaning they are already exercising security diligence. The fraudulent sites exploit that diligence by mimicking the visual language of compliance tools: official-looking logos, structured fee flows, and progress-indicator animations that mirror real data queries. Cryptopolitan and Malwarebytes both noted that this social engineering layer makes the scam particularly effective: each deceptive step is presented as a normal part of a security verification process. The small fee demand, in particular, serves as a legitimacy prop — users accustomed to paying nominal fees for compliance reports are primed to accept it.","heading":"Social Engineering and Psychological Exploitation","sources":[{"url":"https://www.cryptopolitan.com/fake-crypto-aml-checkers-drain-wallets/","name":"Fake crypto AML checkers push users to approve wallet-draining transactions — Cryptopolitan","type":"news_article","credibility":2},{"url":"https://www.malwarebytes.com/blog/threat-intel/2026/08/scammers-are-using-fake-crypto-aml-checkers-to-drain-your-wallet","name":"Scammers are using fake crypto AML checkers to drain your wallet — Malwarebytes","type":"research","credibility":1}],"severity":"high"},{"content":"Malwarebytes researcher Stefan Dasic identified the same underlying scam template operating under multiple distinct names and logos simultaneously, indicating the kit is being redistributed or resold across multiple operators rather than controlled by a single actor. No single threat actor has been publicly named or attributed by any Tier 1 source as of the date of this report. The broader fake-site ecosystem targeting crypto users has been assessed as extensive: for context, CoinDCX reported more than 1,200 fake websites impersonating its platform were identified between April 2024 and January 2026, though that figure pertains to a separate impersonation campaign and is cited only to indicate the general scale of crypto-site fraud. No specific aggregate victim-loss figure for this AML checker campaign has been published by Malwarebytes or any other primary source consulted; the $1 billion figure cited by some secondary sources derives from a Federal Trade Commission report covering all crypto scams since 2021 and is not specific to this campaign.","heading":"Scale and Distribution","sources":[{"url":"https://www.malwarebytes.com/blog/threat-intel/2026/08/scammers-are-using-fake-crypto-aml-checkers-to-drain-your-wallet","name":"Scammers are using fake crypto AML checkers to drain your wallet — Malwarebytes","type":"research","credibility":1},{"url":"https://en.coin-turk.com/malwarebytes-warns-of-fake-aml-crypto-sites-targeting-wallet-permissions/","name":"Malwarebytes warns of fake AML crypto sites targeting wallet permissions — CoinTurk","type":"news_article","credibility":2}],"severity":"high"},{"content":"Malwarebytes issued the following guidance: any AML checker that requests wallet connection rather than a plain public address input should be treated as a warning sign and abandoned immediately. Additional red flags include: requests to sign any transaction or approve any token permission; demands for a small fee before revealing a result; and prompts to enter a seed phrase or private key under any circumstances. For users who have already interacted with a suspected fake site, recommended steps vary by severity of exposure. If a wallet was connected but no transaction was approved: disconnect the wallet from the site immediately and revoke all unrecognized token permissions using a permission management tool (such as Revoke.cash or the native revocation interface of the connected wallet). If a transaction was approved: move remaining assets to a new wallet as soon as possible and revoke all outstanding permissions on the compromised wallet. If a seed phrase or private key was entered: treat the wallet as fully compromised, assume all assets are at risk, and do not use that wallet again. Cryptocurrency transactions cannot be reversed; recovery of drained funds is not possible through blockchain reversal.","heading":"Warning Signs and Remediation","sources":[{"url":"https://www.malwarebytes.com/blog/threat-intel/2026/08/scammers-are-using-fake-crypto-aml-checkers-to-drain-your-wallet","name":"Scammers are using fake crypto AML checkers to drain your wallet — Malwarebytes","type":"research","credibility":1},{"url":"https://www.pcrisk.com/removal-guides/32520-fake-amlbot-website-scam","name":"Fake AMLBot Website Scam — PCRisk removal guide","type":"research","credibility":2},{"url":"https://www.pcrisk.com/removal-guides/33236-amlbot-crypto-checking-scam","name":"AMLBot Crypto Checking Scam — PCRisk removal guide","type":"research","credibility":2}],"severity":"medium"},{"content":"AMLBot (amlbot.com) is a legitimate, commercially operated cryptocurrency compliance and wallet-screening service. It is the primary victim of brand impersonation in this campaign, not a participant in the fraudulent activity. The legitimate AMLBot service requires only a public wallet address for screening and does not prompt users to connect wallets, sign transactions, or approve token permissions. Users seeking genuine AML screening should access only the verified domain amlbot.com and should not trust any site reached through search advertisements, social media links, or unsolicited messages claiming to offer AML checks.","heading":"Relationship to Legitimate AMLBot Service","sources":[{"url":"https://amlbot.com/crypto-checker","name":"AML Crypto Check — AMLBot official site","type":"official","credibility":1},{"url":"https://www.malwarebytes.com/blog/threat-intel/2026/08/scammers-are-using-fake-crypto-aml-checkers-to-drain-your-wallet","name":"Scammers are using fake crypto AML checkers to drain your wallet — Malwarebytes","type":"research","credibility":1}],"severity":"low"}],"timeline":[{"date":"2026-08-19","event":"Malwarebytes researcher Stefan Dasic published a threat-intelligence report documenting the fake crypto AML checker wallet-drainer campaign, identifying the same scam kit operating under multiple rebranded names.","source":"Malwarebytes","source_url":"https://www.malwarebytes.com/blog/threat-intel/2026/08/scammers-are-using-fake-crypto-aml-checkers-to-drain-your-wallet"},{"date":"2026-08-20","event":"Decrypt independently reported on the campaign, corroborating the Malwarebytes findings and noting that multiple fake AML sites were circulating simultaneously.","source":"Decrypt","source_url":"https://decrypt.co/376029/fake-crypto-aml-drain-users-wallets"},{"date":"2026-08-20","event":"Cryptopolitan published additional coverage identifying specific fake domains including amlbot-clear[.]com, audittrust[.]shop, bitget-aml[.]com, search-aml[.]net, and swapstoken[.]app.","source":"Cryptopolitan","source_url":"https://www.cryptopolitan.com/fake-crypto-aml-checkers-drain-wallets/"},{"date":"2026-08-20","event":"Security Boulevard republished the Malwarebytes report, extending distribution of the campaign warning.","source":"Security Boulevard","source_url":"https://securityboulevard.com/2026/08/scammers-are-using-fake-crypto-aml-checkers-to-drain-your-wallet/"},{"date":"2026-08-27","event":"PCRisk published removal guides for two distinct fake AMLBot site variants, documenting additional fake domains: amlbot.seize[.]report, amlbot[.]sale, amlbotchecks[.]com, aml-safety[.]app, amlbotchecking[.]com, aml-safety[.]one, amlnix[.]com, and amlbot[.]club, among others.","source":"PCRisk","source_url":"https://www.pcrisk.com/removal-guides/32520-fake-amlbot-website-scam"}],"sources_used":[{"url":"https://www.malwarebytes.com/blog/threat-intel/2026/08/scammers-are-using-fake-crypto-aml-checkers-to-drain-your-wallet","name":"Scammers are using fake crypto AML checkers to drain your wallet — Malwarebytes","type":"research","archive_url":"http://web.archive.org/web/20260821030159/https://www.malwarebytes.com/blog/threat-intel/2026/08/scammers-are-using-fake-crypto-aml-checkers-to-drain-your-wallet","credibility":1,"archive_timestamp":"2026-08-21T03:01:59+00:00"},{"url":"https://decrypt.co/376029/fake-crypto-aml-drain-users-wallets","name":"Fake Crypto AML Checkers Are Trying to Drain Users' Wallets — Decrypt","type":"news_article","archive_url":"http://web.archive.org/web/20260821084108/https://decrypt.co/376029/fake-crypto-aml-drain-users-wallets","credibility":2,"archive_timestamp":"2026-08-21T08:41:08+00:00"},{"url":"https://www.cryptopolitan.com/fake-crypto-aml-checkers-drain-wallets/","name":"Fake crypto AML checkers push users to approve wallet-draining transactions — Cryptopolitan","type":"news_article","archive_url":"http://web.archive.org/web/20260825025836/https://www.cryptopolitan.com/fake-crypto-aml-checkers-drain-wallets/","credibility":2,"archive_timestamp":"2026-08-25T02:58:36+00:00"},{"url":"https://securityboulevard.com/2026/08/scammers-are-using-fake-crypto-aml-checkers-to-drain-your-wallet/","name":"Scammers are using fake crypto AML checkers to drain your wallet — Security Boulevard","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://hackread.com/fake-aml-sites-crypto-approving-malicious-transactions/","name":"Fake AML Sites Trick Crypto Users Into Approving Malicious Transactions — HackRead","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://www.pcrisk.com/removal-guides/32520-fake-amlbot-website-scam","name":"Fake AMLBot Website Scam — PCRisk removal guide","type":"research","archive_url":"http://web.archive.org/web/20260518124532/https://www.pcrisk.com/removal-guides/32520-fake-amlbot-website-scam","credibility":2,"archive_timestamp":"2026-05-18T12:45:32+00:00"},{"url":"https://www.pcrisk.com/removal-guides/33236-amlbot-crypto-checking-scam","name":"AMLBot Crypto Checking Scam — PCRisk removal guide","type":"research","archive_url":"http://web.archive.org/web/20260208051009/https://www.pcrisk.com/removal-guides/33236-amlbot-crypto-checking-scam","credibility":2,"archive_timestamp":"2026-02-08T05:10:09+00:00"},{"url":"https://en.coin-turk.com/malwarebytes-warns-of-fake-aml-crypto-sites-targeting-wallet-permissions/","name":"Malwarebytes warns of fake AML crypto sites targeting wallet permissions — CoinTurk","type":"news_article","archive_url":"http://web.archive.org/web/20260825003938/https://en.coin-turk.com/malwarebytes-warns-of-fake-aml-crypto-sites-targeting-wallet-permissions/","credibility":2,"archive_timestamp":"2026-08-25T00:39:38+00:00"},{"url":"https://amlbot.com/crypto-checker","name":"AML Crypto Check — AMLBot official site","type":"official","archive_url":"http://web.archive.org/web/20260802022532/https://amlbot.com/crypto-checker","credibility":1,"archive_timestamp":"2026-08-02T02:25:32+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-08-27T12:20:24.977377+00:00","updated_at":"2026-08-27T13:49:08.290039+00:00"}}