Trust Wallet Phishing: Fake Site With .cam Ending

Which topics should we dive deeper into?

Select what genuinely interests you. Your picks feed directly into our editorial planning.

Crypto news that's actually worth your time.

Weekly. 60 seconds. Carefully curated by our editors: no hype, no promo flood, no spam.

Trust Wallet phishing has a new address: the fake site trastwallet[.]cam poses as Trust Wallet and asks you to connect your wallet. The real address is trustwallet.com. Anyone who does not compare the two addresses letter by letter lands on a page whose code reads balances and prepares transfers to hard-coded recipients. Binance founder Changpeng Zhao publicly warned about it on November 5 with the terse line “.cam is not .com”.

For you as a crypto investor in Germany, this is more than a footnote from the scene. According to the analysis, the site targets not only Trust Wallet but also Phantom and OKX Wallet. That covers users of the three most widespread software wallets for Ethereum, BNB Chain and Solana. If you use one of these apps, you should know how to spot the fake and what you can do if you have already tapped “Connect”. An overview of reputable apps is in our comparison of software wallets.

Trust Wallet phishing: what is known about trastwallet[.]cam

The site was discovered by security researcher Anurag, who publishes on X as Malwarehunter. Depending on the report, he found it on November 4 or November 5. He posted screenshots and excerpts from the site's JavaScript code, and Zhao shared the findings with his followers shortly afterwards. The trade outlet crypto.news described the analysis in detail.

The page carries the title “Review your wallet transfers”. It shows a card design and a large button for connecting the wallet. Supposedly an automated service reviews your transfers, with a per-asset limit of $1 to $5,000, network fees and a wallet authorisation. No such service exists at Trust Wallet. The presentation is only meant to explain why you should connect your wallet in the first place.

One important point of context: when the researcher examined the site, the signing function was switched off. The code contained every building block for theft, but in this version it could not get the prepared transactions executed. Whether the operators were still testing or planned to enable the function later is unclear. Stolen amounts clearly attributable to this site have not been documented so far.

Trust Wallet has long been a popular target

Trust Wallet is one of the most widely used software wallets and is therefore a frequent template for fakes. In December 2025 version 2.68 of its Chrome extension contained malicious code; users lost around $7 million at the time, and Zhao promised compensation. On October 28, 2026, Trust Wallet itself also warned about a fake crypto card site that has nothing to do with the company. How the wallet performs in everyday use is covered in our Trust Wallet review.

Typosquatting: one swapped letter and .cam instead of .com

The trick behind the address is called typosquatting. It means a domain that looks deceptively similar to a well-known address and relies on typos or careless reading. trastwallet[.]cam contains two deviations in the name: the “u” in “trust” becomes an “a”, and the .com ending becomes .cam. On a small phone screen neither stands out, especially if you tap a link in a message and never read the address bar at all.

The .cam ending is a regular top-level domain that anyone can register. Visually it resembles .com, but it has nothing to do with Trust Wallet. Scammers use the same principle with hyphens (“trust-wallet-support”), add-ons such as “-fix” or “-verify”, and subdomains in which the real brand name comes first and the actual domain only at the end. What always counts is the part directly before the first single slash, that is, the registered domain including its ending.

One safeguard that works reliably: never open wallet sites via links, only via a bookmark you set yourself once, or directly in the installed app. Search engine ads are not a safe route either, as fake wallet sites keep appearing there too.

Wallet drainer: how the script reads balances and prepares transfers

Technically, the site belongs to the family of wallet drainers. A wallet drainer is a program on a website that, once you connect your wallet, reads your balances and presents you with transactions to sign that send your coins and tokens to the attackers. According to the analysis, the code of trastwallet[.]cam has exactly these two parts: an interface that queries balances and a file that establishes the connection to Trust Wallet, Phantom and OKX Wallet.

The sequence is almost always the same on such sites. First you connect the wallet, and the site sees your public address. Then it reads which coins and tokens sit on that address and sorts them by value. After that, a signature request appears in your wallet, often disguised as a “review”, “confirmation” or “activation”. Signing authorises the transfer to the recipient addresses fixed in the code. The fact that the site supports several wallets and scans balances in advance suggests that the operators want to pick out the most lucrative accounts.

Connecting a wallet and signing a transaction are two different permissions

Many users think connecting the wallet is already the dangerous step. That is only partly true. By merely connecting, you reveal your public address to a site, information anyone can look up in a blockchain explorer anyway. The site cannot move anything with it. That is unpleasant, because the operators now know which address is worth targeting, but it is not yet a loss.

The danger comes with the signature. A signature is your digital authorisation of a transaction or a message, created with your private key. On Ethereum and BNB Chain it can be a token approval, which allows a third-party smart contract to move tokens out of your wallet. On Solana, several transfers can be bundled into a single transaction. Since the Pectra upgrade on Ethereum, there is a further variant, delegation under EIP-7702, which temporarily binds your address to third-party code. What to watch out for is explained in our article on EIP-7702 delegation.

The rule of thumb: read every signature request before you confirm. If your wallet shows a transfer, an unlimited approval or a warning about an unknown contract even though you only wanted to “review” something, cancel. A site that supposedly only reviews transfers does not need your signature.

Seed phrase and private key: no genuine wallet site asks for them

The second big variety of wallet phishing works without a signature. The fake asks you to connect or “restore” your wallet “manually” and shows input fields for the seed phrase or private key. The seed phrase, also called the recovery phrase, is the list of 12 or 24 words from which all the keys of your wallet can be derived. Whoever knows it owns your coins, no matter which device they enter it on.

Trust Wallet itself stresses that the company never asks for your recovery phrase, neither in the app nor by email. The same applies to Phantom, OKX Wallet and every other reputable provider of a self-custody wallet. Self-custody means that only you hold the keys and no company stores them for you. That is precisely why no support agent can replace a lost phrase or reverse a transfer. Why the recovery phrase never belongs in a cloud or a browser field is explained in our piece on the three most common mistakes when setting up Trust Wallet.

How to spot a fake from the way it behaves

The site creates time pressure, for example with an alleged security flaw, a lock or a deadline.
The site asks for a signature for something that needs none, such as a “review” or a “synchronisation”.
The site offers a field for a seed phrase, private key or keystore file.
You arrived via a message, an ad or a social media post, not via your bookmark.

Checking the URL in the browser: the address bar gives the fake away before you connect

The address bar is your most important tool. On a phone, tap the bar once so that the full address appears, and read it from right to left: first the ending, then the name in front of it. For Trust Wallet it must say trustwallet.com, with no hyphen, no add-on and no other ending. A padlock icon proves nothing, because scam sites also have a valid encryption certificate.

Germany's Federal Office for Information Security, the BSI, sets out in its guide to recognising phishing the same basic rules that apply to crypto: distrust links in messages, type addresses yourself and never enter login details on pages you did not open yourself. Wallets add one particular feature. With a bank account you may be able to have a fraudulent transfer reversed; on a blockchain a confirmed transaction is final.

A simple separation also helps. Use a separate wallet with a small balance for trying out new sites and applications, and keep larger amounts apart, ideally on a hardware wallet. A hardware wallet is a small device that stores your private keys offline and shows every transaction on its own screen before you confirm it. There too you have to read what you sign, but the keys never leave the device. We present suitable models further below.

The alleged iOS flaw: the report of $1.1 million is unconfirmed

On the same day as Zhao's warning, the X account Emperor.SOL spread the claim that an unknown attacker had stolen around $1.1 million from Trust Wallet users through a vulnerability in iOS 18.5, extracting seed phrases from their devices. The post showed screenshots of USDT transfers of 500,000, 100,000 and 190,000 Tether to deposit addresses at Binance. According to the account, Trust Wallet support advised updating iOS immediately.

Little of this is documented. The screenshots do not show how the transfers relate to an iPhone flaw, and the trade reports list the claim as unconfirmed. As far as is known, it has nothing to do with the fake .cam site. Regardless, an up-to-date operating system always makes sense: updates close security holes, and older iOS versions have indeed been targeted by attacks on crypto apps in the past. A wallet on a phone that no longer receives updates is not a good place for larger amounts.

Revoking token approvals: after an accidental signature, time matters

If you have already signed something on a suspicious site, act immediately. The first step is to move any remaining balances to a new, clean wallet whose seed phrase has never come into contact with the suspicious site. If you entered the seed phrase itself, the old wallet is permanently lost: every address derived from that phrase must be treated as compromised from now on, even if it still holds funds.

If you only granted a token approval, you can revoke it. On Ethereum and compatible networks, tools such as Revoke.cash or the approvals section of a blockchain explorer show which contracts you have given access to and let you withdraw the approval with a transaction of your own. That costs a small network fee and only works going forward. Revoking does not bring back tokens that have already been drained. Important: open such tools only via an address you type yourself too, because scammers deliberately fake revoke sites as well.

Reporting in Germany: police, consumer advice centres and the BSI take phishing cases

If you have lost money, you should file a police report. Every German federal state has an online police station through which you can file a criminal complaint for fraud or computer fraud. Have the address of the phishing site, the transaction IDs, your affected wallet address and the recipient addresses ready. You will find the transaction ID in your wallet or in the blockchain explorer. Screenshots of the site and of the message that brought you there also help investigators.

You can also report fake sites and emails to the Phishing-Radar of the consumer advice centre, which collects and publishes warnings. If an exchange to which the stolen coins were forwarded is involved, it is worth reporting to its security team with the transaction IDs: centralised exchanges may be able to freeze incoming funds. Crypto exchanges with a MiCA licence have fixed reporting channels and a contact person in the EU. Whether an exchange holds such a licence is shown in the public register of the European Securities and Markets Authority, ESMA.

Be careful after the damage: shortly after a loss, so-called recovery services often get in touch and promise to retrieve the coins against an upfront payment. That is almost always the second wave of fraud. Genuine investigators and lawyers ask neither for your seed phrase nor for payment in crypto. What these data-breach phishing emails look like in detail is shown in our guide to recognising crypto phishing after a data breach.

Trust Wallet phishing: three habits against fake wallet sites

The trastwallet[.]cam site is not a one-off but a pattern that repeats with every new domain. Fixed habits help more against the scam than specialist tools:

A verified app as your starting point. Download your wallet only from the official app store or the manufacturer's website and open applications from within the app. Which software wallets suit everyday use is shown in the software wallet comparison.
Larger amounts offline. Whatever you do not need every day belongs on a device whose keys never come into contact with a website. Suitable devices are in our comparison of hardware wallets.
Buying and selling with regulated providers. For trading, use an exchange licensed in the EU and withdraw to your wallet only what you want to hold yourself. A selection is in the list of regulated crypto exchanges.

(As of November 6, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)

Frequently asked questions about Trust Wallet phishing

The real Trust Wallet address is trustwallet.com. The fake trastwallet[.]cam reported in November 2026 differs by one letter and by its ending, so read the address bar in full from right to left before every connection.

By merely connecting, the site only sees your public address. It becomes dangerous with a signature or a token approval, because that authorises transfers to the attackers.

No. According to Trust Wallet, it never asks for your recovery phrase, neither in the app nor by email. Any site that offers a field for a seed phrase or private key is a fake.

Move the remaining balances immediately to a new wallet with a new seed phrase and revoke any token approvals granted. In Germany you should also file a report via your federal state's online police station.

Transparency note: This article was produced with the assistance of artificial intelligence and reviewed by our editorial team before publication. All figures and claims were checked against the primary sources linked in the text. The feature image was generated with AI.

Which topics should we dive deeper into?

Select what genuinely interests you. Your picks feed directly into our editorial planning.

Crypto news that's actually worth your time.

Weekly. 60 seconds. Carefully curated by our editors: no hype, no promo flood, no spam.

Phantom Wallet and Solscan: What a Solana Transfer Really Costs and Where It Fails

A transfer on Solana costs 0.000005 SOL, a new token account ties up 0.00148844 SOL once — both values measured on-chain by us today. This practical guide shows how to set up Phantom, how to get there from the exchange, how to read Solscan and what applies for tax in Germany.

October 23, 2026 10:21 PM

Ngrave phishing: $2.56 million left 70 wallets after a hijacked push provider

Attackers hijacked the push provider of Belgian hardware wallet maker Ngrave and sent fake security alerts to users of the LIQUID app on October 17. Anyone who entered their recovery words lost their balance: between $2.56 million and $2.65 million flowed out, while the devices themselves remained untouched according to the company.

September 10, 2026 9:13 AM

Trezor Hack Scare: That STM32 Entropy Email Is a Phishing Attack

Trezor users received a fake STM32 entropy warning sent from a real Trezor address. Here is what happened and what to do if you clicked.

September 10, 2026 1:14 PM

Phishing Email From the Real Sender Address: How to Check a Wallet Security Warning

An alleged security warning to wallet customers travelled through the manufacturer's genuine sending channel and passed every technical authenticity check. The test that still holds costs you four minutes.

August 31, 2026 7:20 AM

Browser Extensions as Wallet Thieves: How a Sports App Became a Seed Phrase Collector

In August 2026 the security firm Socket disclosed two separate campaigns: 40 confirmed malicious Firefox extensions and 19 for Chrome and Edge, all of them from the official marketplaces. Nine of them were harmless sports apps that only turned into wallet thieves through an update.

November 3, 2026 1:45 AM

Foundation Passport: 23,000 phishing emails came from the wallet maker's own systems

Hardware wallet maker Foundation has admitted that attackers got into its backend infrastructure through a self-hosted application and sent more than 23,000 phishing emails from the company's genuine systems. According to the company, the Passport devices and private keys are untouched, but around 5,600 postal addresses are not.

September 19, 2026 10:11 PM

North Korean Hackers Drain 7,000 Crypto Wallets: What to Check on Job Offers and Coding Tests

Seven agencies, among them Germany's BND and BfV, warn about the WaterPlum group: 30,000 infected machines, more than 7,000 drained wallets. The bait is a job offer, the trap a coding test.

August 22, 2026 4:13 AM

SafePal Data Breach: 39,798 Customers Exposed With Names, Addresses and Phone Numbers

SafePal confirmed a data breach on August 16, 2026: the names, delivery addresses, phone numbers and order details of 39,798 customers were exposed. Seed phrases and private keys were not affected, but the phishing risk is substantial.

November 4, 2026 1:22 AM

Restoring a Crypto Wallet: Your Seed Phrase Gets the Coins Back

Phone gone or hardware wallet broken? Twelve or 24 words get you back to your coins. Here is how the recovery works, and where it most often fails.

August 11, 2026 1:32 PM

How to Store a Seed Phrase Safely: What Steel, a Passphrase and Multisig Do for Your Wallet Backup

The Coldcard case pushed the manufacturer question to the front, while barely touching on where the backup is kept. This guide places paper, steel, the passphrase and splitting methods against the BIP-39 and SLIP-0039 standards.

October 17, 2026 10:44 PM

Creating a Bitcoin wallet: the first ten minutes decide who has access

A Bitcoin wallet is set up in ten minutes, and that is precisely the danger. Which four steps every setup runs through, why the first transfer should be a test amount, and which five mistakes cost the most.

October 11, 2026 1:24 AM

Three Mistakes When Setting Up Trust Wallet: The Twelve Words Never Belong on the Phone

Trust Wallet is set up in five minutes, yet three mistakes in those minutes regularly cost the entire balance. This guide covers the six steps, the real cost of a swap, and what applies in Germany on the holding period and supervision.

September 17, 2026 4:14 PM

D'CENT App Wallet: How to Tell If Your Recovery Phrase Has to Move Now

Manufacturer IoTrust reports suspicious asset transfers in the D'CENT app wallet and asks users to move their holdings. One question decides the matter: has your recovery phrase ever been entered into the app?

September 23, 2026 4:12 AM

How to Set Up a Crypto Wallet: Securing Your Coins in Seven Steps

Your own crypto wallet is set up in twenty minutes, yet a single step decides everything that follows. This guide takes you through wallet type, recovery words and the test amount, and sets out what BaFin and the tax office expect.

November 2, 2026 9:43 PM

How to store crypto safely: protect yourself from hacks like the one at Binance

After the $6.3 billion hack at Binance: how to store your cryptocurrencies safely. Hardware wallets compared, wallet scanners such as MetaMask Security Alerts, the key settings on your exchange account and a seven-step checklist.

October 5, 2026 1:36 PM

Paper Wallet with a Single Key: The Printed Storage Method Compared with the Seed Phrase

A paper wallet carries a single private key on paper, and that is exactly where its weaknesses lie: printers, change, misread characters. What the storage method achieves, where it fails and how to wind up an old sheet safely.

October 2, 2026 10:36 AM

Hot Wallet or Cold Wallet: the Private Key Decides How Safe Your Coins Are

Hot wallet or cold wallet: the difference rests solely on whether the private key is online. What separates the two forms, where the limits of hardware lie and why moving to your own device triggers no tax.

September 30, 2026 7:16 AM

Tangem Wallet: The Card Without a Seed Phrase vs the Classic Hardware Wallet

The Tangem Wallet secures crypto with two or three identical cards instead of 24 words. What the sets cost, what the EAL6+ chip delivers and why losing every card is final.

September 16, 2026 4:12 AM

Wallet Drops a Network: How to Rescue Your Coins Before the Deadline

Phantom is ending Sui support on September 24, 2026, and Trust Wallet has already removed 25 networks: five shutdowns of this kind in four weeks alone. What really happens to your balance, which two routes you have before the deadline and where the move most often fails.

September 15, 2026 3:53 PM

Waltio Confirms Brevo Breach Touched Its User Emails: Here Is What To Do Now

Waltio has told users its Brevo account was accessed during the September breach that also hit Trezor and BitBox. Here is what was exposed.

September 4, 2026 10:17 AM

Cypher Shutdown on September 6: What Users Should Know Now the Withdrawal Deadline Has Passed

Recap as of September 27, 2026: Cypher had announced it would take its app, dApp and withdrawal window offline on September 6, 2026 and end the token protocol. This article describes the situation before the deadline, how the payout worked and what our own measurement showed at the time about what was left of the CYPR token.

August 31, 2026 1:22 PM

Cosmostation Wallet Shutdown on September 1: What Cosmos Wallet Users Should Know Now the Deadline Has Passed

Recap as of September 27, 2026: Cosmostation had announced it would discontinue its wallet apps on September 1, 2026, leaving only the export of the recovery phrase and the private key. This article describes the situation before the deadline and how to move Cosmos holdings, including delegated ATOM.

August 31, 2026 10:12 AM

Fake AML Checks for Crypto Wallets: How to Spot the Scam Sites

Fraudulent websites pose as money-laundering screening services for crypto addresses and ask you to connect your wallet. A genuine check needs only the public address, and three of the domains named by Malwarebytes still respond twelve days later.

December 26, 2025 1:50 PM

Breaking: Trust Wallet Chrome Extension Hack Drains $7M, Full Reimbursements Promised

A supply-chain attack hit Trust Wallet’s Chrome extension, draining $7M from users. Binance’s CZ says all victims will be reimbursed.

November 2, 2026 9:25 AM

Trezor Safe 5 implant reported at CryptoBilis: who needs a new wallet now

Trezor is warning everyone who has ordered from former reseller CryptoBilis since March 2026: an extra board with a cellular module in a Safe 5 is said to read the recovery phrase. Who is affected, why weighing the device does not help, and how to move to a new wallet.

October 29, 2026 3:40 PM

$13.84 million in 48 hours: Arkham says the drainer is “still moving funds”

Arkham Intelligence puts the haul of the CryptoBilis Ledger drainer at 95.35 million dollars across 1,486 addresses and reports 13.84 million dollars moved within 48 hours. Ten million USDT sit frozen, and Ledger traces every confirmed case back to one retail route.

October 26, 2026 12:15 AM

Coldcard class action over $140 million: what it means for owners

A proposed class action against Coldcard maker Coinkite is before a court in Ontario: a firmware flaw allegedly made recovery phrases predictable, and the claim puts the Bitcoin drained as a result at more than $140 million. What owners of an affected device should check and document now.