CZ Warns of Fake Trust Wallet Site Supporting 3 Major Wallets

CZ Flags a Fake Trust Wallet Domain

Binance co-founder Changpeng Zhao has warned crypto users about a phishing website built to imitate Trust Wallet and trick visitors into connecting their wallets, effectively exposing a hot wallet to attacker-controlled code. The fake page, hosted at trastwallet[.]cam, swaps the “u” in the real domain for an “a” and changes the extension from “.com” to “.cam”, a difference that is easy to miss on a small screen. Security researcher Anurag, who publishes on X as Malwarehunter, identified the site and published an analysis of its malicious JavaScript. Zhao amplified the warning to his followers on November 5, writing: “More phishing websites out there... .cam is not .com. Be careful!” The page presents itself under the title “Review your wallet transfers” and advertises a per-asset transfer limit ranging from $1 to $5,000. Once a visitor connects a wallet, the script can scan balances through a backend application programming interface and prepare transfers to recipient addresses already fixed in the code. According to Anurag’s technical findings, the JavaScript supports three widely used wallets: Trust Wallet, Phantom and OKX Wallet, which extends the operation’s reach across several wallet services. He identified two working components: a wallet scanning endpoint and a JavaScript integration file responsible for handling wallet connections. His post also included a screenshot of the page, which shows a digital payment card design and a prominent button asking visitors to connect their wallets. The page also describes the service as an automatic asset review process, with references to network fees and wallet authorization. The researcher documented the setup in a public post, noting one limitation: transaction signing was disabled when he examined the site, which restricts what this version of the script could actually execute.

Phishing Emails and a $1.1M iOS Claim

The warning lands during a wider phishing wave aimed at the wallet’s user base. On November 3, cybersecurity firm Bitdefender reported that scammers were exploiting the recent Binance security breach to send fake emails impersonating Trust Wallet, instructing recipients to complete a mandatory wallet verification procedure or face suspension after November 7. The campaign reached users in the United States, the United Kingdom, Australia, Ireland and South Africa, and directed them to counterfeit verification sites where wallet credentials or the recovery phrase behind an HD wallet could be harvested. Separately, an unconfirmed claim circulated on November 5 alleging that an attacker had stolen roughly $1.1 million from Trust Wallet users through an exploit affecting devices running iOS 18.5. The claim, shared by the X account Emperor.SOL, said the attack could extract seed phrases from affected phones and quoted Trust Wallet support urging users to update their operating systems immediately. A screenshot posted alongside it showed transfers of 500,000, 100,000 and 190,000 USDT involving Binance deposit addresses and hot wallets, although it did not establish how those transactions connected to the alleged iPhone exploit. The warnings follow other user complaints: on November 4, Iaroslav Dubovoi reported that 3,830 USDT vanished from his wallet without any approval prompt, and on October 28 the company flagged a fraudulent card website promising a $100,000 spending limit, 8% cashback and issuance for $1. In December 2025, version 2.68 of the Trust Wallet Chrome extension was found to contain malicious code, with reported losses eventually reaching millions of dollars; Zhao said at the time that affected users would receive compensation.

Brand Abuse, Not a Single Flaw

COINOTAG’s reading: the common thread is brand abuse rather than one technical flaw, since every recent incident borrows Trust Wallet’s identity, from the .cam domain to the fake card offer. The deployed phishing script was examined with signing disabled, which limited its immediate payout capacity, but a working balance-scanning endpoint and transfer-preparation code indicate the operators built the capability to activate that step. The $1.1 million iOS figure remains unconfirmed, and the circulating screenshot does not tie those USDT transfers to the alleged exploit. Users can reduce exposure by keeping long-term funds in cold storage, as explained in our guide to how hardware wallets work, and by knowing how to recover a crypto wallet if recovery data leaks. Alternatives such as the Tangem Mobile Wallet remove browser exposure entirely. Trust Wallet previously said users needed no action after critical PHP vulnerabilities scored 9.2. Phishing pages rely on urgency and FOMO, so verifying the address bar character by character matters more than any single patch. For market context, TWT technical analysis tracks current support and resistance levels.