Trust Wallet Phishing: Fake .cam Site Also Targets Phantom and OKX Wallet

Trust Wallet phishing has a new address: the fake site trastwallet[.]cam poses as Trust Wallet and asks you to connect your wallet. The real address is trustwallet.com. Anyone who does not compare the two addresses letter by letter lands on a page whose code reads balances and prepares transfers to hard-coded recipients. Binance founder Changpeng Zhao publicly warned about it on November 5 with the terse line “.cam is not .com”.

For you as a crypto investor in Germany, this is more than a footnote from the scene. According to the analysis, the site targets not only Trust Wallet but also Phantom and OKX Wallet. That covers users of the three most widespread software wallets for Ethereum, BNB Chain and Solana. If you use one of these apps, you should know how to spot the fake and what you can do if you have already tapped “Connect”. An overview of reputable apps is in our comparison of software wallets.

Trust Wallet phishing: what is known about trastwallet[.]cam

The site was discovered by security researcher Anurag, who publishes on X as Malwarehunter. Depending on the report, he found it on November 4 or November 5. He posted screenshots and excerpts from the site's JavaScript code, and Zhao shared the findings with his followers shortly afterwards. The trade outlet crypto.news described the analysis in detail.

The page carries the title “Review your wallet transfers”. It shows a card design and a large button for connecting the wallet. Supposedly an automated service reviews your transfers, with a per-asset limit of $1 to $5,000, network fees and a wallet authorisation. No such service exists at Trust Wallet. The presentation is only meant to explain why you should connect your wallet in the first place.

One important point of context: when the researcher examined the site, the signing function was switched off. The code contained every building block for theft, but in this version it could not get the prepared transactions executed. Whether the operators were still testing or planned to enable the function later is unclear. Stolen amounts clearly attributable to this site have not been documented so far.

Trust Wallet has long been a popular target

Trust Wallet is one of the most widely used software wallets and is therefore a frequent template for fakes. In December 2025 version 2.68 of its Chrome extension contained malicious code; users lost around $7 million at the time, and Zhao promised compensation. On October 28, 2026, Trust Wallet itself also warned about a fake crypto card site that has nothing to do with the company. How the wallet performs in everyday use is covered in our Trust Wallet review.

Typosquatting: one swapped letter and .cam instead of .com

The trick behind the address is called typosquatting. It means a domain that looks deceptively similar to a well-known address and relies on typos or careless reading. trastwallet[.]cam contains two deviations in the name: the “u” in “trust” becomes an “a”, and the .com ending becomes .cam. On a small phone screen neither stands out, especially if you tap a link in a message and never read the address bar at all.

The .cam ending is a regular top-level domain that anyone can register. Visually it resembles .com, but it has nothing to do with Trust Wallet. Scammers use the same principle with hyphens (“trust-wallet-support”), add-ons such as “-fix” or “-verify”, and subdomains in which the real brand name comes first and the actual domain only at the end. What always counts is the part directly before the first single slash, that is, the registered domain including its ending.

One safeguard that works reliably: never open wallet sites via links, only via a bookmark you set yourself once, or directly in the installed app. Search engine ads are not a safe route either, as fake wallet sites keep appearing there too.

Wallet drainer: how the script reads balances and prepares transfers

Technically, the site belongs to the family of wallet drainers. A wallet drainer is a program on a website that, once you connect your wallet, reads your balances and presents you with transactions to sign that send your coins and tokens to the attackers. According to the analysis, the code of trastwallet[.]cam has exactly these two parts: an interface that queries balances and a file that establishes the connection to Trust Wallet, Phantom and OKX Wallet.

The sequence is almost always the same on such sites. First you connect the wallet, and the site sees your public address. Then it reads which coins and tokens sit on that address and sorts them by value. After that, a signature request appears in your wallet, often disguised as a “review”, “confirmation” or “activation”. Signing authorises the transfer to the recipient addresses fixed in the code. The fact that the site supports several wallets and scans balances in advance suggests that the operators want to pick out the most lucrative accounts.

Connecting a wallet and signing a transaction are two different permissions

Many users think connecting the wallet is already the dangerous step. That is only partly true. By merely connecting, you reveal your public address to a site, information anyone can look up in a blockchain explorer anyway. The site cannot move anything with it. That is unpleasant, because the operators now know which address is worth targeting, but it is not yet a loss.

The danger comes with the signature. A signature is your digital authorisation of a transaction or a message, created with your private key. On Ethereum and BNB Chain it can be a token approval, which allows a third-party smart contract to move tokens out of your wallet. On Solana, several transfers can be bundled into a single transaction. Since the Pectra upgrade on Ethereum, there is a further variant, delegation under EIP-7702, which temporarily binds your address to third-party code. What to watch out for is explained in our article on EIP-7702 delegation.

The rule of thumb: read every signature request before you confirm. If your wallet shows a transfer, an unlimited approval or a warning about an unknown contract even though you only wanted to “review” something, cancel. A site that supposedly only reviews transfers does not need your signature.

Seed phrase and private key: no genuine wallet site asks for them

The second big variety of wallet phishing works without a signature. The fake asks you to connect or “restore” your wallet “manually” and shows input fields for the seed phrase or private key. The seed phrase, also called the recovery phrase, is the list of 12 or 24 words from which all the keys of your wallet can be derived. Whoever knows it owns your coins, no matter which device they enter it on.

Trust Wallet itself stresses that the company never asks for your recovery phrase, neither in the app nor by email. The same applies to Phantom, OKX Wallet and every other reputable provider of a self-custody wallet. Self-custody means that only you hold the keys and no company stores them for you. That is precisely why no support agent can replace a lost phrase or reverse a transfer. Why the recovery phrase never belongs in a cloud or a browser field is explained in our piece on the three most common mistakes when setting up Trust Wallet.

How to spot a fake from the way it behaves

• The site creates time pressure, for example with an alleged security flaw, a lock or a deadline.
• The site asks for a signature for something that needs none, such as a “review” or a “synchronisation”.
• The site offers a field for a seed phrase, private key or keystore file.
• You arrived via a message, an ad or a social media post, not via your bookmark.

Checking the URL in the browser: the address bar gives the fake away before you connect

The address bar is your most important tool. On a phone, tap the bar once so that the full address appears, and read it from right to left: first the ending, then the name in front of it. For Trust Wallet it must say trustwallet.com, with no hyphen, no add-on and no other ending. A padlock icon proves nothing, because scam sites also have a valid encryption certificate.

Germany's Federal Office for Information Security, the BSI, sets out in its guide to recognising phishing the same basic rules that apply to crypto: distrust links in messages, type addresses yourself and never enter login details on pages you did not open yourself. Wallets add one particular feature. With a bank account you may be able to have a fraudulent transfer reversed; on a blockchain a confirmed transaction is final.

A simple separation also helps. Use a separate wallet with a small balance for trying out new sites and applications, and keep larger amounts apart, ideally on a hardware wallet. A hardware wallet is a small device that stores your private keys offline and shows every transaction on its own screen before you confirm it. There too you have to read what you sign, but the keys never leave the device. We present suitable models further below.

The alleged iOS flaw: the report of $1.1 million is unconfirmed

On the same day as Zhao's warning, the X account Emperor.SOL spread the claim that an unknown attacker had stolen around $1.1 million from Trust Wallet users through a vulnerability in iOS 18.5, extracting seed phrases from their devices. The post showed screenshots of USDT transfers of 500,000, 100,000 and 190,000 Tether to deposit addresses at Binance. According to the account, Trust Wallet support advised updating iOS immediately.

Little of this is documented. The screenshots do not show how the transfers relate to an iPhone flaw, and the trade reports list the claim as unconfirmed. As far as is known, it has nothing to do with the fake .cam site. Regardless, an up-to-date operating system always makes sense: updates close security holes, and older iOS versions have indeed been targeted by attacks on crypto apps in the past. A wallet on a phone that no longer receives updates is not a good place for larger amounts.

Revoking token approvals: after an accidental signature, time matters

If you have already signed something on a suspicious site, act immediately. The first step is to move any remaining balances to a new, clean wallet whose seed phrase has never come into contact with the suspicious site. If you entered the seed phrase itself, the old wallet is permanently lost: every address derived from that phrase must be treated as compromised from now on, even if it still holds funds.

If you only granted a token approval, you can revoke it. On Ethereum and compatible networks, tools such as Revoke.cash or the approvals section of a blockchain explorer show which contracts you have given access to and let you withdraw the approval with a transaction of your own. That costs a small network fee and only works going forward. Revoking does not bring back tokens that have already been drained. Important: open such tools only via an address you type yourself too, because scammers deliberately fake revoke sites as well.

Reporting in Germany: police, consumer advice centres and the BSI take phishing cases

If you have lost money, you should file a police report. Every German federal state has an online police station through which you can file a criminal complaint for fraud or computer fraud. Have the address of the phishing site, the transaction IDs, your affected wallet address and the recipient addresses ready. You will find the transaction ID in your wallet or in the blockchain explorer. Screenshots of the site and of the message that brought you there also help investigators.

You can also report fake sites and emails to the Phishing-Radar of the consumer advice centre, which collects and publishes warnings. If an exchange to which the stolen coins were forwarded is involved, it is worth reporting to its security team with the transaction IDs: centralised exchanges may be able to freeze incoming funds. Crypto exchanges with a MiCA licence have fixed reporting channels and a contact person in the EU. Whether an exchange holds such a licence is shown in the public register of the European Securities and Markets Authority, ESMA.

Be careful after the damage: shortly after a loss, so-called recovery services often get in touch and promise to retrieve the coins against an upfront payment. That is almost always the second wave of fraud. Genuine investigators and lawyers ask neither for your seed phrase nor for payment in crypto. What these data-breach phishing emails look like in detail is shown in our guide to recognising crypto phishing after a data breach.

Trust Wallet phishing: three habits against fake wallet sites

The trastwallet[.]cam site is not a one-off but a pattern that repeats with every new domain. Fixed habits help more against the scam than specialist tools:

1. A verified app as your starting point. Download your wallet only from the official app store or the manufacturer's website and open applications from within the app. Which software wallets suit everyday use is shown in the software wallet comparison.
2. Larger amounts offline. Whatever you do not need every day belongs on a device whose keys never come into contact with a website. Suitable devices are in our comparison of hardware wallets.
3. Buying and selling with regulated providers. For trading, use an exchange licensed in the EU and withdraw to your wallet only what you want to hold yourself. A selection is in the list of regulated crypto exchanges.

(As of November 6, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)