A fake “Bitget AML check” drained 101 wallets of $233,000 — the site is still online

Malwarebytes described the scheme in August: fake AML checkers that look like AMLBot, with a progress bar, a “clean, low risk” verdict and a report to download. Of the 17 domains Malwarebytes and PCrisk listed, 16 are parked or gone. bitget-aml.com still works.

Its code is plain to read. Step one asks which USDT you hold — BEP-20 or ERC-20. Step two connects your wallet and checks the balance. If you hold at least 0.5 USDT on BNB Chain (or 500 USDT on Ethereum), it asks you to approve the contract 0xB17c9aBd32c73BEeBA9bC885A94FB529938bF995 to spend an unlimited amount of your USDT, and then has your wallet call that contract’s forwardToken with your entire balance and the operator’s address as the recipient. If you hold less, you go straight to step three and get the reassuring verdict.

A real AML check needs nothing but the address. No approval, no signature, no wallet connection. If a site asks for any of those, it is not checking your wallet — it is taking it. You can check any address on our address check without connecting anything.

The contract behind bitget-aml.com was deployed on 6 December 2025 by 0x5E98c4453cF64bF743dB92087B0Bb768a571931D. The same address deployed six more contracts since March 2025. Three of them have the same forwardToken function and were used the same way: one from April to November 2025, two briefly in early December 2025.

We read the receipt of every forwardToken call on all four: 118 transfers, 239,089 USDT. Eight of the wallets that “lost” money had been funded by the operator just before — tests. Without them: 101 wallets, about 233,400 USDT. 59 wallets lost 124,500 USDT in 2025; 42 wallets lost 108,900 USDT through the current contract between December 2025 and 9 July 2026. The median loss was 1,800 USDT; nine people lost more than 5,000 each; the largest single drain was 23,832.85 USDT on 27 May 2026.

The site’s code also names an Ethereum contract and an Ethereum recipient. No one has been drained there yet — but the Ethereum recipient, 0x0B429bC12F16D5dC7EBd4835bEFb1FDCD52b7150, is the same address that received 59,500 USDT of the 2025 drains on BNB Chain. That is what ties the live site to the older contracts.

The drains landed on six receiving wallets that pay each other and the operator’s test wallets — one ring. From there the money went out in small amounts through Wormhole, Stargate, PancakeSwap, KyberSwap and OKX’s DEX router. The biggest single exit is a Bybit deposit address: 0xd6ba8c79379a3a645072bc7a3f1ee3ca5c68dd6f received 42,239 USDT from the main receiver in April and May 2026 and forwarded it to Bybit’s hot wallet. A second Bybit deposit address, 0xe709a0c0b9cd955033c218b7fba59a3353ca7f65, received 2,743 USDT. A deposit address belongs to one exchange account; Bybit can see whose.

We marked 18 addresses in our database as phishing: the four drainer contracts, the operator’s other three contracts, the deployer, the six receiving wallets, the two Bybit deposit addresses, and the Ethereum contract and recipient named in the site’s code. None of them was marked before. We did not mark the victims, the bridges or the exchanges’ own wallets.

This is the second fake AML checker we have read in a week; the first, AML.legal, drained Tron wallets and was the top result in Google’s AI answer. The pattern is the same: the people most careful about where their money came from are the ones being targeted.

It does not say who runs the site, and it does not say Bitget, AMLBot or Bybit have anything to do with it — the site uses their names and look without permission. Our count covers the four contracts with a forwardToken function on BNB Chain; it does not cover a fifth contract of the same deployer used in March 2025, or other domains we have not found. Figures read from BNB Chain on 10 October 2026.