Binance co‑founder Changpeng Zhao (CZ) used his X account on November 5 to warn crypto users about a phishing website that mimics Trust Wallet. The site, hosted at trastwallet.cam, lures visitors into connecting their wallets under the pretense of “reviewing transfers.” Security researcher Anurag, who runs the Malwarehunter X account, posted technical details showing the page can interact with Trust Wallet, Phantom and OKX Wallet, scan balances via a backend API and prepare transactions to hard‑coded addresses.

How the fake site operates

According to Anurag’s analysis, the page displays a “Review your wallet transfers” banner and a button that prompts users to connect their wallet. Once a connection is made, JavaScript code contacts a scanning endpoint that retrieves the wallet’s token holdings. A second script then constructs transfer payloads aimed at attacker‑controlled addresses, with per‑asset limits ranging from $1 to $5,000. While the code includes the logic needed to sign transactions, Anurag noted that signing was disabled in the version he examined, limiting the immediate threat to preparation of transfers rather than execution.

Broader phishing campaign targeting Trust Wallet users

The Trust Wallet phishing scheme appears to be part of a larger wave of attacks. Bitdefender reported on November 3 that scammers were exploiting the recent Binance security breach to send fake verification emails claiming Trust Wallet users needed to confirm their accounts. The emails, sent to users in the United States, United Kingdom, Australia, Ireland and South Africa, directed recipients to counterfeit verification sites where credentials could be harvested. Earlier in the year, CYFIRMA documented phishing attempts that used malicious QR codes on Telegram to target Trust Wallet holders.

Separate iOS exploit claims

In parallel, an unverified claim circulated on X that an attacker stole roughly $1.1 million from Trust Wallet users by exploiting a vulnerability in iOS 18.5. The post, attributed to the Emperor.SOL account, said the exploit could extract seed phrases from affected iPhones and urged users to update their operating system immediately. Trust Wallet support reportedly echoed the update recommendation, though no official statement confirming the loss amount has been released.

What to watch next

Investors and wallet users should monitor further disclosures from Trust Wallet and Apple regarding the alleged iOS vulnerability. Security researchers are expected to publish more detailed code analyses of the trastwallet.cam site, which could reveal whether transaction signing is later re‑enabled. Finally, watch for additional phishing campaigns that may leverage recent high‑profile breaches, as attackers appear to be capitalising on heightened user anxiety.