Scammers Target Crypto Investors with Fake AML Checks

A recent wave of fake Anti-Money Laundering (AML) checks has been targeting crypto investors, according to Malwarebytes. These scam sites claim to provide AML checks for crypto wallets, but in reality, they are phishing operations designed to steal users' funds.

The scammers set up websites that mimic legitimate AML providers, such as AMLBot. They prompt users to connect their wallet, which allows the site to access sensitive information and potentially drain the user's balance. The sites use a progress bar to create a sense of legitimacy, while the real purpose is to extract funds from the user's wallet.

A legitimate AML check requires only the public address of the crypto wallet, not access to the wallet itself or any sensitive information. Malwarebytes has documented several domains that are still active and operating this scam. To avoid falling victim to these scams, users should be cautious when encountering websites claiming to offer AML checks. They should look for websites that only require a public address and do not ask for wallet access.

The scammers use the approval mechanism in crypto wallets to extract funds from unsuspecting users. An approval is a permission granted by the user to allow a third-party address to move funds out of their wallet. If an approval is unlimited, it can remain active even after the user has closed the website or disconnected from the site.