Wallet Connection Prompts Are a Sign of a Fake AML Check Website

cryptonews.ruPublicado em 2026-08-21Última atualização em 2026-08-21

Resumo

Fake anti-money laundering (AML) verification sites are stealing from cryptocurrency investors. These websites trick users into connecting their wallets and signing transactions, which is unnecessary for a basic wallet check, as discovered by Malwarebytes. Legitimate wallet verification only requires a public address to analyze transaction history for links to hacks, thefts, or sanctioned entities. The fraudulent sites, some copying brands like AMLBot, mimic this process. After a user initiates a scan, they are prompted to connect their wallet, shown fake progress bars, and sometimes asked to pay a small "fee." Eventually, a false "clean, low risk" verdict is given to download a report. Connecting a wallet reveals the public address and assets, allowing scammers to craft targeted transactions for the victim to approve, which can drain funds. Malwarebytes warns that any AML checker requesting wallet connection instead of just a public address is a major red flag. The report details that the same malicious template is repackaged under different names. It also mentions a $500 scam kit advertised on cybercrime forums that creates fake token presales, scans visitor wallets for valuable assets, and attempts to steal secret recovery phrases by offering a bonus. The article advises users who connected only a wallet to revoke the site's permissions. Those who signed suspicious transactions should check activity and move funds to a new wallet if compromised. Anyone who entered a re...

Fake anti-money laundering check websites are stealing money from crypto investors.

These websites prompt users to connect a wallet and sign a transaction, which is not required for a genuine wallet verification. Malwarebytes discovered this attack this week.

Only the Public Address is Needed for Genuine Wallet Verification

Under anti-money laundering regulations, banks and regulated firms are required to verify that their clients are not linked to criminal activities.

In the cryptocurrency space, such checks involve analyzing the public transaction history of a wallet address for connections to hacks, thefts, sanctioned entities, or other suspicious activity.

According to Malwarebytes researcher Stefan Dasic, fraudulent websites take this concept and weaponize it.

Some copy the branding of AMLBot, a legitimate AML checking service. Others operate under generic names like 'AML Check.'

A visitor selects a cryptocurrency, clicks a scan button, and is then prompted to connect their wallet to see the result.

One version analyzed by Malwarebytes displays a progress bar with messages like 'Checking wallet history...' and 'Checking compliance...', then shows a fake error asking for a small top-up to 'cover the fee.'

Click 'Retry,' and the animation runs again, eventually giving a reassuring verdict of 'Clean, low risk' and offering to download a report.

A genuine basic check requires only the wallet's public address. It is a simple lookup, with no signing, granting permissions, or connecting the wallet.

'If an anti-money laundering checker asks you to connect your wallet rather than just enter its public address, treat it as a red flag,' the Malwarebytes team wrote.

Connecting a wallet does not hand over keys but does reveal the public address. This allows the operators to see what assets are inside and craft transactions targeting that specific wallet.

This transaction is then sent to the victim for approval. Approval is the point at which funds start to move.

Researchers advise not approving unexpected transactions.

Malwarebytes found the same malware kit being used under different names and logos. The kit is being renamed and resold.

$500 Kit Uses Recovery Phrase Phishing, Promises 15% Bonus

This month, Cryptopolitan reported on a $500 ready-made kit available on a cybercrime forum. The kit creates a fake $TSLA presale and scans each visitor's wallet for valuable holdings.

The scammers then attempt to phish the 12-word recovery phrase by offering a 15% bonus. An admin panel automatically inflates balances artificially to keep victims paying.

In May, Solana Floor uncovered a scheme flooding Solana wallets with counterfeit '$CJUP' tokens, mimicking the Jupuary airdrop from Jupiter Exchange and redirecting recipients to a fake website, as Cryptopolitan reported at the time.

CoinDCX reported discovering over 1,212 fake websites impersonating its platform between April 2024 and January 2026. Mumbai police have registered a complaint regarding fraud committed via a website impersonating CoinDCX.

Malwarebytes advised anyone who has only connected a wallet to disconnect the site. Anyone who granted a token permission to their wallet should check for unfamiliar permissions and revoke them.

Anyone who signed something unclear should check recent activity and, if funds are compromised, transfer everything to a new wallet. Anyone who entered a recovery phrase or private key should assume the wallet is compromised.

Criptomoedas em alta

CitreaCTR

wrapped stUSDTWSTUSDT

Velodrome FinanceVELODROME

Perguntas relacionadas

QAccording to the article, what is a key red flag that a cryptocurrency AML (Anti-Money Laundering) checking website is likely a scam?

AThe key red flag is if the website asks you to connect your wallet, rather than simply enter your wallet's public address. Legitimate AML checks only require a public address.

QHow do the fake AML websites ultimately steal money from victims?

AThey trick victims into connecting their wallets, which allows the operators to see the assets inside. They then send a targeted transaction for the victim to approve. Signing/approving this transaction allows the money to be transferred out.

QWhat did Malwarebytes researchers discover about the malware kits used to create these fake sites?

AThey discovered that the same malware template is being used under different names and logos. The kits are being renamed and resold to various criminals.

QWhat is the purpose of the $500 kit mentioned in the article that was sold on a cybercrime forum?

AThe $500 kit creates a fake $TSLA presale website. It scans each visitor's wallet for valuable assets and then tries to trick them into revealing their 12-word seed phrase by offering a 15% bonus.

QWhat three actions does Malwarebytes recommend for users based on their level of interaction with a suspicious site?

A1. If you only connected a wallet, disconnect the site. 2. If you granted token permissions, review and revoke any unfamiliar approvals. 3. If you signed something unknown, check recent activity. If funds were taken, move remaining assets to a new wallet. 4. If you entered a seed phrase or private key, assume the wallet is compromised.

Leituras Relacionadas

South Korean lawmakers seek expanded FIU powers over unregistered crypto firms

A group of South Korean lawmakers has introduced a bill to expand the Financial Intelligence Unit's (FIU) investigative powers over unregistered crypto businesses. The proposed amendment would allow the FIU to directly investigate and analyze alleged violations, file complaints, and request criminal probes, rather than relying solely on police. Currently, police have suspended most investigations into unregistered overseas-based firms referred by the FIU. Crypto firms serving South Korea must register, with 28 registered and 40 suspected illegal operators referred to authorities as of June.

cointelegraphHá 6m

South Korean lawmakers seek expanded FIU powers over unregistered crypto firms

cointelegraphHá 6m

Garlinghouse Says 67M US Crypto Owners Show Industry Has Gone Mainstream

Ripple CEO Brad Garlinghouse cites a new survey estimating that 67 million Americans, roughly 25% of U.S. adults, own cryptocurrency. He argues this signals the industry's move from a niche interest into the financial mainstream. The figure, from the National Cryptocurrency Association and Harris Poll's 2026 report, is based on a survey of 10,000 respondents rather than a verified registry, but still indicates significant adoption. Garlinghouse uses the data to support the argument that crypto now has a substantial user base, influencing both commercial strategies and political policy. The growing ownership implies crypto can no longer be ignored by lawmakers, shifting the debate from whether people will adopt crypto to how they will use it. The report acknowledges survey estimates require careful interpretation but underscores crypto's expanding role in everyday finance.

bitcoinistHá 16m

Garlinghouse Says 67M US Crypto Owners Show Industry Has Gone Mainstream

bitcoinistHá 16m

Bitcoin Short Squeeze Sent XRP Tumbling to $1.29 While Bitcoin Funds Held Steady

A sharp short squeeze in Bitcoin propelled XRP to surge by roughly 30% last week, trading near $1.29 and reaching its highest level in months. The rally, which saw XRP's best performance since early February, was primarily driven by events on Wednesday, including Bitcoin breaking above $72,000 and triggering a record $2.75 billion in BTC short liquidations. Market sentiment was further buoyed by the U.S. Treasury's announcement to increase long-term bond buybacks, seen as a sign of easing financial conditions. Interestingly, this price surge occurred even as demand from U.S. spot Bitcoin ETFs, which had previously fueled XRP's bullish momentum with 30 consecutive days of net inflows, appeared to subside. XRP's daily RSI reached 79.2, indicating the asset was entering overbought territory. While the token's price climbed, open interest for XRP began to decline by over 11% from its rally peak, suggesting some of the leveraged positions behind the rise were unwinding. At the time of reporting, XRP traded around $1.26, up 11.3% for the day and 23.1% for the week.

cryptonews.ruHá 41m

Bitcoin Short Squeeze Sent XRP Tumbling to $1.29 While Bitcoin Funds Held Steady

cryptonews.ruHá 41m

Cryptocurrencies, Artificial Intelligence, and Online Bookmakers Drive Record $517 Million Corporate Spending on Election Campaigning

Cryptocurrency, AI, and online gambling companies are behind record corporate spending of $517 million on the 2026 U.S. elections, according to Public Citizen. This amount, directed toward congressional races in just 15 months, already exceeds total corporate spending for the entire 2024 cycle. Funds are channeled through Super PACs and affiliated networks, allowing unlimited donations. Key contributors include companies like Coinbase, Ripple, Andreessen Horowitz, and Meta, alongside personal spending from billionaires such as Elon Musk and Sergey Brin. The crypto industry's main Super PAC, Fairshake, with a war chest of $193 million, has shifted strategy to support politicians based on policy stance rather than party, targeting critics like Senator Sherrod Brown, who has since softened his opposition. With an estimated $11.6 billion in total political ad spending expected, corporate cash is a major driver. Fairshake still has $130 million available for the November elections, and Musk plans to spend beyond his current $90 million, signaling that corporate political investment will continue to surge.

cryptonews.ruHá 43m

Cryptocurrencies, Artificial Intelligence, and Online Bookmakers Drive Record $517 Million Corporate Spending on Election Campaigning

cryptonews.ruHá 43m

Perspective: Value Investing in U.S. Stocks Is Not the Same as Fundamental Investing

The article challenges the notion that value investing in US stocks is equivalent to fundamental investing. It uses the astronomical analogy of Henrietta Leavitt separating a star's apparent brightness from its intrinsic luminosity to illustrate a key investment framework: an observed valuation multiple (like brightness) conflates two things—the actual quality of a business and the premium the market is willing to pay for its future (its "distance" or duration). The author argues that the popular narrative of "fundamentals are dead"—fueled by momentum and concentration in mega-cap tech—is flawed. While recognizing factors like winner-take-all dynamics and AI scale advantages, the piece warns against confusing broad thematic truths (e.g., "AI is big") with justified valuations for specific companies. It introduces a 2x2 matrix categorizing stocks based on whether they *looked* cheap/expensive at a point in time versus whether they *were* actually cheap/expensive in hindsight (e.g., expensive-looking Meta in 2022 was actually cheap). The core formula presented is: Forward Return ≈ Fundamental Growth × Change in Valuation Multiple. Over short periods, multiple changes drive returns, making markets seem narrative-driven. Over the long term, fundamental growth dominates. The article concludes that markets may be becoming *less* efficient due to complex, long-duration business models, narrative cycles, and private market dynamics, creating more opportunities for investors who can disentangle real quality from market sentiment.

marsbitHá 45m

Perspective: Value Investing in U.S. Stocks Is Not the Same as Fundamental Investing

marsbitHá 45m

Trading

Spot

Artigos em Destaque

Como comprar CHECK

Bem-vindo à HTX.com!Tornámos a compra de Checkmate (CHECK) simples e conveniente.Segue o nosso guia passo a passo para iniciar a tua jornada no mundo das criptos.Passo 1: cria a tua conta HTXUtiliza o teu e-mail ou número de telefone para te inscreveres numa conta gratuita na HTX.Desfruta de um processo de inscrição sem complicações e desbloqueia todas as funcionalidades.Obter a minha contaPasso 2: vai para Comprar Cripto e escolhe o teu método de pagamentoCartão de crédito/débito: usa o teu visa ou mastercard para comprar Checkmate (CHECK) instantaneamente.Saldo: usa os fundos da tua conta HTX para transacionar sem problemas.Terceiros: adicionamos métodos de pagamento populares, como Google Pay e Apple Pay, para aumentar a conveniência.P2P: transaciona diretamente com outros utilizadores na HTX.Mercado de balcão (OTC): oferecemos serviços personalizados e taxas de câmbio competitivas para os traders.Passo 3: armazena teu Checkmate (CHECK)Depois de comprar o teu Checkmate (CHECK), armazena-o na tua conta HTX.Alternativamente, podes enviá-lo para outro lugar através de transferência blockchain ou usá-lo para transacionar outras criptomoedas.Passo 4: transaciona Checkmate (CHECK)Transaciona facilmente Checkmate (CHECK) no mercado à vista da HTX.Acede simplesmente à tua conta, seleciona o teu par de trading, executa as tuas transações e monitoriza em tempo real.Oferecemos uma experiência de fácil utilização tanto para principiantes como para traders experientes.

599 Visualizações TotaisPublicado em {updateTime}Atualizado em 2026.06.02

Discussões

Bem-vindo à Comunidade HTX. Aqui, pode manter-se informado sobre os mais recentes desenvolvimentos da plataforma e obter acesso a análises profissionais de mercado. As opiniões dos utilizadores sobre o preço de CHECK (CHECK) são apresentadas abaixo.