TL;DR - Fake "AML checker" sites copy real wallet-screening tools, then talk you into connecting your wallet and signing a transaction that drains it.
On August 19, 2026, security researchers at Malwarebytes published a report tracing a wave of copycat sites posing as AMLBot, one of crypto's most recognized wallet-screening brands. The pitch was compliance, not greed. Each site asked visitors to check whether their own wallet carried dirty money before they sent or received funds, which is exactly the kind of caution a real AML habit builds. That's what made the trap work.
The report spread fast. By September 1, at least nine separate outlets, including Decrypt, KuCoin's news desk, and Security Boulevard, had picked up the same warning, and three named security researchers went on record about why the pitch works so well on exactly the people who'd normally spot a scam.
How does the fake AML-checker scam actually work?
The flow runs in four steps, and none of them look unusual until the last one. A user lands on a page built to resemble AMLBot or a lookalike calling itself "AML Check," usually reached through a paid ad or a link dropped in a group chat. The site asks them to pick a chain, hit "Check Wallet," and connect a wallet instead of simply pasting an address.
Once connected, the page runs a fake progress bar with status lines like "Checking wallet history..." and "Verifying compliance...". Some versions throw an invented error and ask for a small top-up to "unlock" the results. Others skip straight to a wallet prompt asking the user to sign a transaction. Either way, the signature is the payload: it hands a malicious contract permission to move the wallet's assets, and a reassuring "Clean, Low Risk" result appears right after the funds are already gone.
Malwarebytes named several of the domains running this pattern, including amlbot-clear[.]com, bitget-aml[.]com, and search-aml[.]net. None of them belong to the brand they copy. The result was fake. The theft wasn't.
Each step past the first is something a real address-only screening check never asks for.
Why do people who already know better fall for it?
Compliance is the lure, not greed. Jason Soroko, a senior fellow at the security firm Sectigo, told reporters the scam "turns compliance into the lure...the victim believes they are reducing risk while granting the attacker permission to move their assets." Robert Coles, a senior manager at Black Duck, was blunter: "No exploit is needed if the person hands over the keys voluntarily."
The victim supplies the exploit.
That line matters because it changes who's at risk. Someone who'd never click a phishing link tied to a fake exchange promo is exactly the person most likely to run a wallet through a "compliance" tool before a big transfer. The framing borrows credibility from an entire industry of real screening vendors, and a request to connect a wallet reads as due diligence instead of a red flag. It's the same mechanic behind other 2026 drainer campaigns, including a fake coding-test scam aimed at developers - convince the wallet's owner to authorize the theft themselves.
How is a real wallet-screening check different?
A real check needs exactly one input: the public address. No connection, no signature, and no advance payment. That's the entire threat model of a legitimate wallet-screening tool: it reads what's already public on the chain and never needs permission to move anything.
A screening corpus built this way is public by design: 3,901 labeled addresses, including 780 pulled straight from OFAC's Specially Designated Nationals list. Matching an address against that corpus and its known counterparties is the whole job. Nothing about it requires touching the wallet's contents.
You can also do a rough version of this by hand: pull the address up on Etherscan, follow the funding trail a few hops, and check whether it touches any address on a public sanctions list. It works, but it's slow, and it only covers one chain at a time. Screen the wallet with Plastron instead to see sanctions, mixer, and stolen-funds exposure across 7 EVM chains in a single query - no connection needed, ever.
The gap between the two lists is the entire scam: a real check has nothing to gain from what the fake one demands.
What should you do if you already connected a wallet, or signed something?
If you only connected the wallet and stopped before signing anything, the damage is probably limited to metadata: the site now knows your address and what it holds. Disconnect the site from your wallet's connected-apps list and move on. Nothing was authorized, so nothing can move.
If you signed a transaction or approved a token allowance on that site, treat the wallet as compromised now. Move remaining assets to a brand-new wallet with a fresh seed phrase rather than staying on the old one - a drainer contract can hold more than one path back in. Before you abandon the old wallet, check every approval it still has open, since a leftover allowance can be exploited even after you've moved everything else out.
Speed matters more than paperwork here. A drainer with a live approval can execute the moment new funds land, so the next 24 hours count for more than any report filed after.
How do you spot a fake AML checker before it drains you?
Four signals separate a real check from a copy.
It asks for a public address, never a wallet connection.
It charges nothing before showing a result.
It never requests a signature or approval to "unlock" anything.
Its domain doesn't match the brand it claims - AMLBot's real site is amlbot.com, not a lookalike with "-clear" or "-aml" bolted onto some other domain.
A tool that needs your signature isn't screening your wallet. It's asking your wallet to screen itself, and handing over the keys to do it. The Malwarebytes report found at least 5 domains running this exact script within weeks of each other, so the pattern is a template now, not a one-off site someone will take down and forget.
FAQ
Does a real AML check ever need me to connect my wallet?
No. Everything a legitimate check needs - transaction history, counterparty exposure, sanctions matches - is already public on the chain and readable from the address alone. A request to connect is a request for something the check doesn't need.
I only connected my wallet and didn't sign anything - am I safe?
Probably. A connection alone reveals your address and balances but can't move funds without a signature. Disconnect the site and watch the wallet for a few days; if nothing moves on its own, no transaction was ever authorized.
Is AMLBot itself involved in this scam?
No. AMLBot is the brand being impersonated, not the source of the fake sites. The scam pages copy its name, logo, and layout on unrelated domains to borrow its reputation.
Can a wallet-screening tool undo a signed approval?
No tool can reverse a signed transaction. Screening tells you what a wallet's history already contains before you act; once a malicious contract has an approval, the fix is moving remaining funds to a new wallet, not re-scanning the old one.
Disclaimer: This article is for educational and informational purposes only and is not legal, financial, tax, or compliance advice. Crypto carries risk; you act on this information at your own risk. Always do your own research and consult a qualified professional before making decisions. Views are the author's own and do not constitute financial, legal, or investment advice.
About Plastron
Plastron is a free, non-custodial wallet screening tool. It checks Ethereum and six EVM chains for AML and KYT risk — sanctions exposure, mixer contact, and stolen-funds proximity — and returns a risk report in seconds. It reads public on-chain data only: it never takes custody of funds and never asks for private keys.