Cybercriminals are exploiting the growing demand for crypto compliance tools by building fake anti-money laundering (AML) checkers designed to trick users into handing over control of their wallets, security researchers warn.
How the Scam Works
The fraudulent services pose as legitimate compliance platforms, promising to help users verify whether their crypto funds are "clean" or linked to illicit activity. In reality, these fake AML checkers are traps. When a user connects their wallet to run a supposed screening, they are prompted to approve a transaction that grants the attacker permission to move their assets.
Because many users are conditioned to sign transactions during routine wallet interactions, the malicious approval often slips through unnoticed. Once granted, the scammer can drain the connected wallet of tokens and other holdings, leaving victims with little recourse.
A tool that claims to protect your funds may be the very thing that empties your wallet.
The scheme preys on rising anxiety around regulatory scrutiny, as more traders worry about inadvertently receiving tainted coins that could be flagged or frozen by exchanges.
Why These Attacks Are Spreading
The surge in fake compliance services reflects a broader trend of scammers weaponizing legitimate-sounding security branding. By dressing up wallet-draining schemes as protective tools, attackers lower their targets' defenses and turn caution into a vulnerability.
Common red flags include services that require wallet connections to perform a check, urgent requests to approve transactions, and platforms with little verifiable history or reputation.
- Never connect your wallet to unverified AML or compliance sites.
- Legitimate address screening does not require transaction approvals.
- Review and revoke suspicious token permissions regularly.
- Treat unsolicited compliance warnings with skepticism.
Security experts urge crypto holders to double-check any transaction request before signing and to rely only on established, well-reviewed compliance providers. As the tactics grow more sophisticated, vigilance remains the strongest safeguard against losing funds to impostor services.