Fake AML Checkers Trick Crypto Holders Into Wallet Drains

Connecting a wallet alone does not allow scammers to steal funds. It reveals the wallet's public address, which lets them see its assets and create a transaction for the victim to approve.

Malwarebytes found the same basic design and process under several names and logos, suggesting the scam template is being reused and rebranded.

Seasoned crypto users are no strangers to these types of ploys, but lately there has been a series of phishing campaigns using fake websites to target crypto holders. Earlier this month, hardware wallet makers Trezor and Foundation warned of phishing emails directing users to a cloned Coldcard website. In March, Malwarebytes uncovered a fake version of Pudgy Penguins' Pudgy World game designed to steal wallet passwords. That same month, crypto exchange CoinDCX said it had identified more than 1,200 websites impersonating its platform between April 2024 and January 2026.

Malwarebytes advised users who approved token access to revoke suspicious permissions. Anyone who entered a recovery phrase or private key should consider the wallet compromised and move their assets to a new wallet.

"Crypto transactions generally can't be reversed once they're confirmed, so acting quickly matters if you've approved something suspicious," Malwarebytes said.