Short answer. A legitimate check of a public cryptocurrency address does not require a seed phrase, private key, transfer of all assets to a new wallet or signature of an unclear transaction. If USDT, USDC, ETH or other assets disappeared after you connected to an “AML service”, stop interacting with the site immediately, determine how the assets were taken, secure the remaining funds, preserve digital traces and begin transaction tracing. Simply disconnecting the website from the wallet may not be enough: a previously granted permission to manage tokens remains active until it is revoked on the relevant blockchain network.
The scenario usually begins plausibly. A user is offered a favourable cryptocurrency exchange, a P2P transaction, withdrawal unblocking or a USDT “cleanliness” check. The other party explains that an AML report is required before the transaction and sends a link to a specialised website. The page displays familiar terms: risk score, sanctions, darknet, source of funds and verification. After the user clicks “Check wallet”, the service asks to connect Trust Wallet, MetaMask or another Web3 wallet and confirm a request. Seconds or some time later, assets are transferred to an unknown address.
This is not a theoretical threat. In August 2026, Malwarebytes researchers described a campaign involving fake AML services that imitate cryptocurrency-wallet screening while actually attempting to gain access to users’ assets.
In such a case, the “AML check” as a procedure did not steal the money. The user was directed to a phishing resource and, without understanding the technical meaning of the request, may have disclosed a seed phrase, signed a transfer or authorised a smart contract to spend tokens. The precise mechanism determines which actions may still prevent further transfers and whether the address can safely remain in use.
How cryptocurrency is stolen through a fake AML check
How a genuine AML check differs from a phishing website
AML in the virtual-asset sector comprises measures that enable services to assess customer, transaction and source-of-funds risks. The international approach is based on risk assessment, customer identification, record keeping and detection of suspicious activity. This is how FATF describes AML/CFT for virtual assets.
For an initial on-chain analysis, a specialist needs only public data: the address, network and, where a particular operation is being examined, its TxID. This information is already on the blockchain. Producing an AML report does not require:
- a seed phrase or private key;
- a wallet backup, keystore file or its password;
- a two-factor authentication code or SMS code;
- installation of remote-access software;
- transfer of all assets to a “safe” or “verification” address;
- funding the wallet to prove solvency;
- signature of a transaction granting unlimited access to tokens.
Connecting a wallet to a website and allowing it to view the public address does not itself transfer funds. The critical point arises when the user signs a transaction or structured message containing permissions they have not reviewed. The statement “I only connected my wallet” may therefore omit an important step: after connection, the interface may have displayed a second request disguised as the start of the check. See also how to check USDT “cleanliness” with AML screening.
Scenario 1. The user disclosed a seed phrase or private key
This is the most dangerous scenario. A seed phrase allows a wallet to be restored on another device and gives control over the associated addresses. The attacker no longer needs the owner’s confirmation: they can sign transactions independently, transfer native coins and tokens across multiple networks, and monitor new incoming funds.
Withdrawal of different assets from several addresses derived from the same seed phrase may indicate complete compromise. An automated sweeper is sometimes used: as soon as ETH, TRX, BNB or another coin needed for fees reaches the compromised address, it is immediately transferred to the attacker. Simply funding the address to withdraw remaining tokens may then cause another loss.
Scenario 2. A direct transfer was signed under the guise of a check
The website interface may describe the action as “wallet verification”, “start scan” or “pay network fee”, while the wallet actually displays an asset-transfer transaction. Once confirmed, the transaction enters the blockchain and generally cannot be cancelled by the wallet owner. The history will show an ordinary outgoing transfer from the victim’s address to the attacker’s address.
Scenario 3. An Approve or Permit permission was granted
Tokens on Ethereum, BNB Smart Chain, Arbitrum, Polygon and other EVM networks can authorise a third-party smart contract to spend a specified amount on the owner’s behalf. This uses the allowance mechanism, commonly created through an Approve transaction. If the user grants unlimited approval, the attacker may later call transferFrom and take the authorised token.
Permissions may also be created through a signed message, including certain implementations of Permit or Permit2. Such a request can appear less dangerous because users may not perceive it as an ordinary transfer. A digital signature can nevertheless confer the right to make a later withdrawal. MetaMask’s official guidance specifically warns that a dangerous token approval may allow a malicious smart contract to take authorised tokens and that revocation terminates that access.
Importantly, a permission normally applies to a specific token, contract and network. If only USDT was taken while ETH and other assets remained, one possibility is that only the USDT allowance was compromised. This does not establish the mechanism by itself; it must be confirmed through smart-contract calls and events. Practical steps are set out in our article on how to revoke a suspicious Approve permission.
Scenario 4. Malicious software was installed or remote access was granted
An “AML specialist” may ask the user to install AnyDesk, RustDesk, TeamViewer, an unknown browser extension or a mobile application. With screen visibility and device control, the attacker can substitute an address, view a backup phrase, initiate a transaction or persuade the owner to confirm it on a hardware wallet. The investigation must then cover both the blockchain and the device: installation history, browser extensions, active sessions, downloads and signs that accounts were compromised.
How to determine what happened to your wallet
Start with the blockchain, not a screenshot showing a zero balance. Sometimes the application does not display the token, the wrong network is open or a different address is selected. If assets were actually transferred, the blockchain explorer will contain a transaction or contract event.
One outgoing transfer immediately after the “check”A direct transfer or contract call was signedTransaction method, recipient, calldata and token eventsAn Approve transaction appeared first, followed by a separate transferThe attacker used an allowanceSpender, approval limit and transferFrom callOnly one type of token was takenPermission was granted for a specific tokenAll active approvals on that networkDifferent assets disappeared across several networksThe seed phrase or device may be compromisedRelated addresses, new outgoing transactions, active sessions and the deviceNew deposits are transferred automaticallyA sweeper is active or the attacker already has the private keyTime between deposit and transfer, fees and recurring recipient addressThe app shows a zero balance but the explorer still shows the assetsDisplay error, wrong network or hidden tokenThe public address in the official explorer for the relevant network
What to do immediately after cryptocurrency is stolen during an AML check
1. Stop interacting with the website and the fraudster
Do not reopen the link, confirm new requests or pay for “transaction cancellation”, “unblocking”, “insurance” or a “clean AML certificate”. Do not follow instructions from the person who sent the site, even if they claim that the transfer was temporary or technical. Preserve the conversation before blocking the contact.
2. Determine the scope of the compromise
Record the wallet address and examine it in the official explorer for the relevant network. Document every unknown outgoing transaction, including its TxID, time, asset and amount. Check other addresses and networks derived from the same seed phrase. If the phrase was entered on the site, exposed during screen sharing or may have reached malicious software, treat the wallet as fully compromised until shown otherwise.
If the seed phrase was not disclosed, examine exactly what was signed. The label on the website’s button has no evidentiary value; the transaction data and smart-contract events matter. A wallet may display the action simply as “Contract interaction”, so the mechanism can be established only by decoding the call. See also how to check a transaction by TxID.
3. Secure the remaining assets
If the seed phrase is compromised, the safe solution is a new wallet created on a clean device with a new seed phrase. The old phrase must not be reused. Remaining assets should be moved to the new address with due regard to network fees and the possibility of an automated sweeper. If valuable tokens remain at the compromised address but there is no native coin for fees, funding it yourself may be risky; first assess the address’s behaviour.
If the problem is limited to a malicious permission, revoke it on every affected network. MetaMask’s official guidance explains that disconnecting a website from a wallet and revoking a token approval are different actions: disconnection alone does not necessarily terminate a smart contract’s right to move tokens. After revocation, check for other signatures, approvals or disclosure of the seed phrase.
You should also:
- end unknown WalletConnect sessions and dApp connections;
- remove suspicious extensions and applications after recording their names and versions;
- change email, exchange and cloud-storage passwords from a clean device;
- reissue API keys and terminate active exchange sessions;
- enable robust two-factor authentication;
- stop using the compromised address for new deposits.
4. Preserve digital evidence
After a theft, users often delete the wallet, clear the browser or reinstall the operating system. This may destroy information useful for establishing the attack mechanism. Before cleaning the device, preserve:
- the full URL and domain name of the fake AML service;
- screenshots and a video recording of the interface if the site remains available and can be opened safely;
- conversations, voice messages, usernames, telephone numbers and email addresses;
- the advertisement, P2P listing or profile through which the fraudster was found;
- the victim’s public address, TxIDs and initial recipient addresses;
- the exact time of events, including the time zone;
- wallet notifications and the content of signature requests, if preserved;
- the names, versions and installation sources of applications or extensions;
- cryptocurrency purchase receipts and exchange-withdrawal confirmations.
The FBI’s guidance for victims of cryptocurrency fraud likewise identifies addresses, the amount and type of cryptocurrency, date, time and TxID as key transaction information. It also recommends preserving communications, domains, applications, information about exchanges used and the sequence of events. This evidence is useful beyond reports in the United States: it provides a clear foundation for an investigation in any jurisdiction.
5. Begin tracing the funds without waiting for the next movement
A public blockchain makes it possible to identify the first recipient address and trace subsequent transactions. Analysis should account not only for direct transfers but also consolidation, amount splitting, swaps, DEXs, cross-chain bridges, exchange services and movement between networks. The objective is to identify points where the assets interacted with a centralised service that may hold the user’s KYC data.
If stolen funds reach an exchange or custodial service, promptly report their origin and provide the TxID, movement path and law-enforcement report details. Support staff, however, generally will not disclose KYC data to a private complainant and are not required to return funds based only on a screenshot. A formal request, order or court decision may be required for a sustained freeze, disclosure of data or seizure, depending on the jurisdiction and the service’s policies. See also our step-by-step guide to recovering stolen cryptocurrency.
6. Report the matter to law enforcement
The report should describe not only the disappearance of funds but also the technical mechanism: where the link came from, which wallet was used, what the user confirmed, which transactions occurred and where the assets subsequently moved. It is advisable to attach a chronology, transaction table and asset-flow graph. In Ukraine, a report can be filed with the police and information about the cyber component submitted through the Cyber Police’s official channels. Speed matters: the Cyber Police notes that cryptocurrency transactions occur almost instantly, leaving analysts and operational officers limited time to respond.
What not to do after a theft
- Do not pay an unknown “recovery specialist”. Victims are often targeted again after publishing an address or reporting a theft.
- Never disclose the seed phrase, even to someone promising to save the remaining assets. A public address and TxID are sufficient for tracing.
- Do not send a test payment to the attacker. It does not prove ownership or reverse a transaction.
- Do not delete conversations or applications before preserving them. Record the evidence first, then clean the device.
- Do not treat revoking Approve as a universal solution. It does not secure a wallet if the seed phrase was disclosed.
- Do not assume that a high AML risk automatically freezes stolen funds. Systems assess addresses differently, and a risk score does not replace procedural action.
Get a consultation
A quick case assessment — no obligation
Can stolen cryptocurrency be recovered, and how ProDefence can help
What determines the prospects of recovery
Cryptocurrency transactions are generally irreversible: the owner cannot cancel a confirmed transfer in the same way as a bank payment. Irreversibility does not make an investigation pointless, however. Transactions on public blockchains leave a digital trail that can reveal asset movement and services that interacted with the attacker’s addresses.
The prospects of recovery are better where:
- the response began before funds left a centralised platform;
- the asset route is supported by TxIDs rather than visual similarity between amounts alone;
- an exchange, conversion service or payment provider capable of identifying its customer has been found;
- law enforcement promptly sends an appropriate request;
- the link between funds reaching the service and the original theft is demonstrated;
- communications, the domain, signing circumstances and victim details have been preserved.
The situation becomes more complex if assets pass through a mixer or privacy protocol, are split among many addresses, exchanged across several networks or withdrawn through a service in a jurisdiction where information is difficult to obtain. Even then, analysis may identify part of the route, related addresses, recurring transactions or the next point of entry into centralised infrastructure.
No responsible specialist can guarantee recovery before analysing the transactions and the legal options in the relevant jurisdictions. A proper initial result is not a promise but a verified picture of asset movement, identification of potential points of attribution and a plan for further action.
How ProDefence investigates theft through a fake AML check
The work begins by separating facts from assumptions. ProDefence specialists examine the public address, outgoing transactions, contract calls and token events. This establishes whether the user signed a direct transfer, granted a spending permission or shows signs of complete wallet compromise.
A technical case file is then prepared, covering:
- a chronology of contact with the fraudster and the user’s actions;
- addresses, TxIDs, assets, amounts, networks and timestamps;
- decoding of Approve, Permit, transferFrom and other material calls;
- the first recipient address and subsequent asset route;
- swaps, bridges, intermediary wallets and consolidation points;
- AML categories and known attributions of related addresses;
- identified exchanges, conversion services and other centralised services;
- the data that should be requested from each particular service;
- materials for reports to platform security teams and law enforcement.
Where necessary, the technical analysis is combined with legal work: circumstances are presented sequentially, verified transaction data are separated from analytical hypotheses, and requests are drafted with the recipient’s jurisdiction in mind. This avoids a situation in which a victim sends an exchange dozens of screenshots but fails to show a verifiable link between the theft and the exchange’s deposit address. If Trust Wallet shows a balance but the assets cannot be transferred, see also our article on cryptocurrency blocked in Trust Wallet.
Information required for an initial assessment
Wallet access is not needed to begin the examination. It is sufficient to provide:
- the victim’s public address and the network name;
- the TxID of the unknown transfer or last known transaction;
- the name and address of the website where the “AML check” occurred;
- screenshots of the wallet and conversations;
- a brief description of what was connected, entered or signed;
- information on whether the seed phrase was disclosed;
- the time the theft was discovered and a list of remaining assets.
You do not need to provide ProDefence with a seed phrase, private key or password. These data are not required to analyse public transactions and should never be shared with third parties.
Frequently asked questions
Can a legitimate AML service ask me to connect a wallet?
Some Web3 services use a wallet connection for authorisation or proof of address ownership. Ordinary analysis of a public address, however, does not require access to assets, a seed phrase or unlimited token approval. Before signing, examine the exact content of the wallet request rather than the label on the website’s button.
Is disconnecting the website from Trust Wallet or MetaMask enough?
No. Ending a session disconnects the interface but does not necessarily cancel a previously granted token approval. Permissions must be reviewed and revoked separately on each network. If the seed phrase was disclosed, revoking approvals does not make the wallet secure again.
Will revoking Approve return stolen USDT?
Revocation may prevent future transfers under that specific permission, but it does not reverse transactions that have already been confirmed. Previously transferred funds require tracing, service identification and further legal action.
Can a fraudster be identified from a wallet address?
An address usually contains no owner name. Identification may become possible if a verified link is established to an exchange, conversion service, payment provider or other infrastructure holding registration, KYC, IP or device data. Access to that information depends on the applicable legal procedure.
Should I wait until the funds reach an exchange?
No. The route should be documented from the first transaction. Waiting wastes time, and an exchange may be used only at an intermediate stage. Monitoring makes it possible to identify significant movement promptly.
Can cryptocurrency recovery be guaranteed?
No. The outcome depends on the route, speed of response, jurisdictions, preservation of evidence, and actions by law enforcement and services. A recovery guarantee offered before analysis is a common sign of an unscrupulous proposal or recovery scam.
What to do right now
If cryptocurrency was taken from your wallet after an AML check, do not carry out new transactions on the instructions of the person who sent the link, and do not fund the compromised address before it has been assessed. Record the address, network, TxID, domain and communications.
ProDefence determines the mechanism of the unauthorised transfer, reviews smart-contract permissions, traces assets through wallets, DEXs, bridges and centralised services, conducts AML analysis and prepares structured materials for further reports. The sooner the review begins, the greater the chance of promptly identifying a point where procedural or service-level intervention remains possible.
Fake AML check
Were USDT or other crypto assets taken after you connected to an “AML website”?
Contact ProDefence — we will determine the transfer mechanism, review Approve and Permit permissions, trace the asset route and prepare materials for exchanges and law enforcement without making unsupported recovery guarantees.
Confidential. We will never ask for a seed phrase or private keys.
This material is for information purposes. The options for freezing assets, obtaining data and recovering funds are assessed individually in light of the network, transaction route, jurisdiction and circumstances of the particular case.
