Fake AML Checkers: How Scammers Drain Crypto Wallets

After a P2P trade, the buyer asks you for an AML report. Or you receive a payment from someone you do not know and see a warning that an exchange may hold “dirty” USDT for additional review. You search for an AML wallet check and land on a site that looks like a normal AML service, except that instead of asking for a public address, it asks you to connect your wallet and sign something.

On August 19, 2026, Malwarebytes documented a network of sites built around this exact scam. They impersonate AML services that assess the risk of a public address or transaction using blockchain data. That makes the setup convincing: you arrive because you are trying to be careful, not because you are chasing an investment or giveaway. Below, we explain how the scam works, what a legitimate AML service actually needs, and what to do if you have already connected your wallet or approved a request.

Why this scam works

The underlying concern is real. USDT can be frozen, and exchanges can place deposits under additional compliance review, so a request to “check the funds first” can sound perfectly reasonable.

On Ethereum and TRON, Tether can add addresses to the USDT blacklist. Once an address is blacklisted, the tokens remain visible on-chain but can no longer be transferred normally. According to BlockSec’s live tracker, as of September 18, 2026, Tether’s blacklist covered 10,289 addresses across Ethereum and TRON with a combined current balance of about $5.93 billion in USDT.

The T3 Financial Crime Unit also operates as a joint initiative of Tether, TRON, and TRM Labs. On May 14, 2026, the group reported that it had frozen more than $450 million in illicit assets since launching in September 2024 and had worked with law-enforcement agencies across 23 jurisdictions.

An exchange may pause a deposit and ask you to explain the source of funds. P2P counterparties sometimes request an AML report before a trade, and some exchange services screen an address or transaction themselves. In that environment, wanting to check crypto before accepting it is understandable.

A USDT freeze and an AML report are different things. Tether can restrict transfers from a specific address at the token level, while an AML service analyzes an address or transaction and assigns a risk assessment using its own data and methodology. A low-risk result does not rule out a future freeze, and a high-risk result does not mean the funds are already frozen.

AML wallet check: what a legitimate service actually needs

An AML wallet check does not require you to connect your wallet: a public address is enough for a basic risk assessment. If you want to check a specific transfer, the service may ask for a transaction hash. There is no reason to sign anything in your wallet just to analyze public blockchain data.

For a basic check, the service does not need:

• your seed phrase or private key;
• a transaction or message signature if the service is only assessing risk;
• a token approval;
• a wallet connection to produce a basic risk score;
• a transfer to a third-party address as an “unlocking fee.”

Public blockchain history is available without any action from you. AML providers add their own analytics on top of it: they cluster related addresses, identify links to exchanges and other services, maintain databases of known hacks, scams, and sanctioned addresses, and score direct and indirect exposure according to their own methodology.

Pricing depends on the provider, report type, and plan: you are paying for an analytical report or access to a platform. “Cleaning,” “certifying,” or unlocking funds is not part of a normal AML check.

The same address can receive different results from different providers. AMLBot attributes these differences to the underlying data, address clustering and attribution, the way direct and indirect exposure is measured, the weight assigned to different risk categories, and the receiving platform’s own compliance policy. A low-risk result from one service therefore does not guarantee that an exchange will accept the deposit automatically.

If you want a deeper explanation of where risk labels come from and how to read an AML report, see our guide “Dirty Crypto: How To Check If Your Funds Are Clean”.

How a fake AML checker works

Malwarebytes documented several sites that followed the same pattern: a polished interface, a network or asset selector, and a prominent check button. After you click it, the site asks you to connect your wallet and approve a request.

A typical flow looks like this:

1. You choose a coin or network and click a button such as “Check Wallet.”
2. The site asks you to connect your wallet, even though a public-address check does not require a connection.
3. Once connected, the site can see your public address and read its balance and transaction history from the blockchain.
4. A fake analysis screen appears with messages such as “Checking wallet history…” or “Verifying compliance…”.
5. During that “check,” your wallet displays a signature request or a transaction for you to confirm.

Domains Malwarebytes recorded in this campaign included amlbot-clear[.]com, audittrust[.]shop, bitget-aml[.]com, search-aml[.]net, and swapstoken[.]app.

There is little value in memorizing a list of domains because scam sites change quickly. Their behavior is a better signal. If a site claims to perform a basic AML check but pushes you to click Connect Wallet and then sign or approve something, close the page and verify the domain. AMLBot also states that its checks do not require a Web3 wallet connection.

Why search results are not enough

Seeing a familiar brand name in search results does not prove that you opened the official site. Malwarebytes recommends checking the actual URL, especially when you arrived through an ad, a message, social media, or a search result.

AMLBot’s official website is amlbot.com, and its Telegram checker is t.me/cryptoaml_bot. Its current documentation also lists t.me/amlbot_support_bot as a support channel. A domain does not become official just because it contains “amlbot” alongside an extra word, a different domain extension, or similar spelling.

Roundups such as “best AML checkers” are not proof of legitimacy either. An affiliate link or a high search ranking does not verify the domain or make the requests shown by the site safe to approve.

How to check a site in one minute

• Open the service from its official documentation or a saved bookmark, not from a random link in a chat.
• Compare the domain character by character. amlbot.com and amlbot-clear.com are different domains.
• Use domain age only as a supporting signal. If a domain was registered recently even though the service claims years of history, verify the address again; WHOIS age alone proves nothing.
• A public address or transaction hash is enough for a basic check. If the site instead insists on Connect Wallet and then asks you to sign a message, grant an approval, or confirm a transaction, close the page and verify the service through its official channels.

What are you actually signing?

Connecting a wallet by itself does not give a website permission to spend your tokens. Once connected, however, the site can see your public address and send requests for signatures or transactions. The danger begins when you approve a request without understanding what it authorizes.

A signature that does not look like a transaction

On EVM networks, a site may ask you to sign a message without sending a transaction. One common format is EIP-712, which lets the wallet display structured data for you to sign. There is no network fee for creating the signature, and the signing action itself will not appear in your transaction history.

EIP-712 defines the format of the signed data; the consequences depend on what the message actually authorizes. ERC-2612 Permit, for example, lets you authorize another address or contract to spend a specified amount of ERC-20 tokens without first sending a separate approve transaction. If a scammer obtains a still-valid Permit signature, they can submit it to the relevant token contract and use the resulting permission.

Permit2 is Uniswap’s permission system, used by a range of dApps. Before Permit2 can work with a token, the user first grants the Permit2 contract a regular token approval. After that, a separate signature can give another application permission to spend tokens, and a single batch signature may cover multiple tokens. A Permit2 request can therefore determine who may spend which assets, so it deserves the same scrutiny as a normal token approval.

We explain Approve, Permit, Permit2, and WalletConnect in a separate guide, including what authority each mechanism grants, why Disconnect is not the same as Revoke, and what to check before signing.

A scammer may use a valid signature immediately or later. If your balance does not change right after you sign, that does not mean the signature was harmless.

Unlimited approvals

A phishing site may also ask you to approve a normal on-chain permission. For ERC-20 tokens, that is usually approve; for NFTs, it is often setApprovalForAll. An approve transaction lets a contract or address spend tokens up to a specified limit. If that limit is extremely large, the permission may cover not only your current token balance but also tokens you receive later, for as long as the approval remains active. setApprovalForAll gives an operator control over every NFT in a particular collection. These transactions are visible on-chain and require a network fee, but your assets may not move at the moment you approve them, which is why the risk can be easy to miss.

TRC-20 approve works on the same basic principle in TRON: you allow a particular address or contract to spend tokens up to a defined limit. For USDT on TRON, an unlimited approval can remain usable until it is changed or revoked.

According to Scam Sniffer, wallet-drainer phishing caused about $494 million in losses across more than 332,000 wallets in 2024. In 2025, losses fell to $83.85 million across 106,106 victims. In January 2026, signature phishing caused $6.27 million in losses across 4,741 victims, with roughly 65% of that month’s total coming from just two incidents.

How a TRON account can lose control

TRON introduces another risk beyond token approvals: the permissions that control the account itself can be changed.

TRON uses two main permission sets. Owner Permission provides full control over the account, including the ability to change other permissions. Active Permission can be limited to specific operation types. Each permission set contains authorized addresses, their weights, and a threshold — the total signing weight required to perform an action. These settings can be changed with an AccountPermissionUpdate transaction.

If you sign a malicious AccountPermissionUpdate, an attacker can add their own address, remove yours, or change the weights and threshold so that your key is no longer sufficient to control the account. The address will continue to exist on-chain and may still receive funds, but you may no longer be able to send them on your own.

TRON and TronLink document this permission system, which is also used for legitimate multisignature setups. However, we found no primary-source evidence that the fake AML sites documented by Malwarebytes specifically used AccountPermissionUpdate. We include it here as a separate risk when interacting with a malicious TRON dApp, not as a confirmed part of that particular campaign.

You can review TRON account permissions in TronScan:

1. Open tronscan.org and search for your address.
2. Open the Permission section.
3. Review Owner Permission, Active Permission, the threshold, authorized addresses, and their weights.

If you did not intentionally configure a multisignature setup, Owner Permission will normally contain your own address with a threshold of 1, and Active Permission should not contain unfamiliar signing addresses. Multiple addresses can be completely legitimate when multisig was configured intentionally.

After a fake AML checker: “certificates,” “unfreezing,” and recovery scams

After the first interaction with a fake AML service, scammers may continue the conversation through a messenger, especially if the victim is already worried or has lost funds.

A fake “manager” may contact you from an account that imitates an AML provider and offer a “premium check,” an “investigation,” or help in exchange for an upfront payment. AMLBot warns about impersonation scams and says it does not ask for seed phrases or private keys, does not require a wallet connection for a basic check, and does not ask users to send funds to a third-party address.

Another variation promises to “unfreeze” USDT or release a held deposit for a fee. The messages may name FATF, the FCA, or ESMA and demand an “unlock deposit” or a payment to remove restrictions. Mentioning a regulator does not prove that the person contacting you represents a legitimate service.

If you have already lost money, you may then be targeted by a recovery scam. A supposed specialist claims to have located the assets and offers to recover them after you pay in advance. Malwarebytes and AMLBot both warn that people who have already lost crypto are frequently targeted again this way.

Tether can remove an address from its blacklist and restore the ability to transfer USDT. The company has said that some cases are handled in coordination with law enforcement and affected owners. Requests involving theft, hacks, fraud, or law-enforcement matters should go through Tether’s official channels, not through “intermediaries” on Telegram.

According to BlockSec’s analysis, roughly 3.6% of blacklisted addresses were removed from the blacklist in 2025, and the median time from freeze to unfreeze among addresses that were eventually released was 18.2 days. Those figures describe past cases; they do not predict how long any particular review will take.

If an exchange has placed a deposit under review, contact its official support or compliance team and provide source-of-funds documents when requested. There is no universal “clean funds certificate” that automatically overrides an exchange’s own review.

What to do after interacting with a suspicious site

You only connected your wallet

Connecting a wallet does not by itself let a website spend your tokens. The connection exposes your public address and the balance and transaction history already visible on-chain, and it allows the site to send requests that you can approve or reject.

Disconnect the unfamiliar site in your wallet settings. In MetaMask Extension, open the account menu → Dapp connections, select the site, and click Disconnect. In TronLink, connected sites are managed under Wallet Management → DApp Connections. Then review token approvals separately: disconnecting a dApp does not revoke token approvals you already granted.

You signed a permission or an unfamiliar message

On EVM networks, you can review token approvals with revoke.cash, which supports more than 100 networks. You can paste a public address into the search field without connecting a wallet. If you decide to revoke an approval, you will then need to connect the wallet and confirm a separate on-chain transaction, which requires a network fee.

EIP-2612 Permit is different because the signature is created off-chain, so revoke.cash cannot know whether you signed one on a particular site. Its Signatures section can show supported tokens with potential Permit signatures, and in some cases you can invalidate those signatures before an attacker uses them. For Permit2, review both the token’s base approval to the Permit2 contract and the active permissions inside Permit2.

On TRON, review token approvals through TronScan or Wallet Management → Approval Management in TronLink. Also inspect the Permission section and make sure Owner Permission and Active Permission were not changed without your knowledge.

There is no universal way to cancel every off-chain signature; it depends on the standard and contract involved. If you cannot determine what you signed and the wallet still holds significant assets, moving those assets to a new wallet with fresh keys is the safer option while you still can.

You entered a seed phrase or private key

If a third-party site obtained your seed phrase, treat every account derived from it as compromised. If you exposed a private key, at minimum the corresponding account is compromised. A seed phrase or private key that has been exposed to someone else cannot be made safe again: you need to move to fresh keys.

Create a new wallet with a new seed phrase on a device you trust, and move any remaining assets as quickly as possible. Do not reuse the old seed phrase or exposed private key. Anyone offering to “recover access” for an upfront fee may simply be running a recovery scam.

For practical backup and offline-storage options, see our guide “How to Store a Seed Phrase: 5 Safe Methods in 2026”.

How to run an AML check without unnecessary risk

• Do not try to “clean” the history of funds by moving them between your own addresses. Blockchain analytics can follow the transaction chain, so the new addresses may inherit the same risk exposure.
• For P2P and large incoming payments, consider using a separate operational address. Avoid connecting the address that holds most of your assets to unfamiliar dApps and websites; this limits the damage from a bad signature and makes transaction history easier to analyze.
• An AML wallet check should start with a public address or transaction hash. Do not enter a seed phrase or private key, and do not sign requests just to “verify” that funds are clean.
• When possible, check the counterparty or specific transaction before accepting a large payment. Checking your own address afterward can still help you understand the situation, but it cannot undo the incoming transfer.
• Look beyond a simple Low or High label. Check the report date, risk categories, direct and indirect exposure, and whether the provider analyzed an address or a specific transaction.

In short

Fake AML checkers exploit a legitimate concern about high-risk or “dirty” crypto. An AML wallet check is based on public blockchain data, so you do not need to connect a wallet simply to obtain a risk assessment. A basic check should not require your seed phrase, private key, or requests such as Approve, Sign, or AccountPermissionUpdate.

If you have already interacted with a suspicious site, first determine what you actually approved: a wallet connection, a token approval, a Permit or Permit2 signature, or a TRON permission change. The right response depends on that distinction. If someone else obtained your seed phrase or private key, move the assets to fresh keys and stop using the compromised credentials.