CZ Flags Fake Trust Wallet Site Hunting Crypto Wallets

Changpeng Zhao has a warning for anyone who clicks crypto links without squinting at the URL. The Binance co-founder flagged a fake Trust Wallet site built to trick people into plugging in their wallets, per u.today. The giveaway is in the domain: attackers swapped the letter 'u' for 'a' and traded '.com' for '.cam'.

The bait is a prompt to connect a wallet in order to 'review transfers.' That's the hook. Behind it sits JavaScript that scans wallet balances through a backend API, mapping out what's there before preparing transfers to addresses the attackers control, according to the report.

This isn't a one-wallet problem. The setup is built to work with Trust Wallet, Phantom and OKX Wallet, so a single slip can expose balances across several of the most popular apps in crypto.

The timing is no accident. On Nov. 3, cybersecurity firm Bitdefender said scammers were riding the recent Binance security breach to blast out fake emails posing as Trust Wallet. Those messages told users they'd been caught up in the breach and had to complete a 'mandatory' wallet verification or get suspended after Nov. 7.

Bitdefender traced the email campaign to users in the United States, United Kingdom, Australia, Ireland and South Africa. The links funneled victims to bogus verification pages designed to harvest wallet credentials or recovery phrases. Trust Wallet users have been a recurring target — earlier this year, CYFIRMA analysts caught attackers pushing malicious QR codes through Telegram to go after the same crowd.

The takeaway is boredom-proof: check the domain character by character, and treat any 'verify your wallet' email as hostile until proven otherwise. CZ's alarm is the latest signal that phishing, not code exploits, remains one of the cheapest ways to drain a crypto balance.