CZ Flags Fake Trust Wallet Site as $1.1M iPhone Exploit Claims Surface

Binance co-founder Changpeng Zhao hopped on X to sound the alarm about a knockoff Trust Wallet website built to harvest wallet connections. He shared findings from security researcher Anurag, who runs the Malwarehunter account, and kept the warning blunt: more phishing sites are out there, and .cam is not .com. The fake page lives at trastwallet[.]cam — one swapped letter away from the real thing.

Anurag spotted the site on November 5 and dug into the malicious JavaScript behind it, according to crypto.news. The script reaches for Trust Wallet, Phantom and OKX Wallet, then scans balances through a backend API and lines up transfers to recipient addresses already baked into the code. Visitors see a page titled “Review your wallet transfers,” complete with a payment-card graphic, a connect-wallet button and a promised per-asset limit between $1 and $5,000. One saving grace: the transaction signing function was switched off when the researcher took a look, so the version he examined couldn't finish what it started.

The same day, a separate warning made the rounds claiming an unidentified attacker drained about $1.1 million from Trust Wallet users via an exploit tied to Apple's iOS 18.5. The X account Emperor.SOL said the attack could pull seed phrases straight off affected devices, and quoted Trust Wallet support telling people to update their operating systems immediately. The post showed a screenshot of transfers touching Binance deposit addresses and hot wallets, including 500,000 USDT, 100,000 USDT and 190,000 USDT — though nothing in that image proved a link to the alleged iPhone exploit.

It's the latest bruise in a rough stretch for Trust Wallet users. On November 4, crypto.news reported that a user, Iaroslav Dubovoi, found 3,830 USDT gone from his wallet with no approval or heads-up. Another user said someone posing as support on NEAR Protocol's Discord drained his holdings, and on October 28 Trust Wallet flagged a bogus crypto card site promising a $100,000 spending limit and 8% cashback for a $1 card fee. Security team member James Bro confirmed that site had no affiliation with the company.

Older iPhones have been a recurring sore spot. In March, researchers from Google, Lookout and iVerify identified the DarkSword exploit, which hit vulnerable iPhones through compromised websites and could expose wallet data before Apple patched it. Trust Wallet itself took a hit with version 2.68 of its Chrome extension, which shipped malicious code and led to losses reportedly reaching millions; Zhao later said affected users would be compensated. On November 1, OneKey founder Yishi Wang warned that hardware flaws in models from the iPhone 4S through the iPhone 11 and the second-generation iPhone SE can't be fixed by ordinary software updates, and told anyone who exposed a recovery phrase on those devices to start fresh with new wallets.