CZ warns of fake Trust Wallet site built to scan and drain crypto wallets
In brief
- Binance co-founder Changpeng Zhao warned of a fake Trust Wallet website on a lookalike domain, U.Today reported.
- The fake site asked users to connect wallets, claiming it needed to review their transfers.
- The site's code tried to scan balances and prepare transfers to specific wallet addresses.
- Bitdefender separately flagged fake Trust Wallet emails threatening suspension after Nov. 7.
How the fake site worked
According to U.Today's account of CZ's warning, the fraudulent page sat on a fake domain that mimicked the real Trust Wallet website. The attackers swapped a single letter in the name and moved the address off its usual .com extension (we aren't printing the full domain, so nobody lands on it by accident).
The pitch itself was simple. Users were told to connect their wallets so the site could review their transfers.
Behind that prompt, U.Today reported, sat JavaScript that tried to scan wallet balances through a backend API in order to prepare transfers to specific wallet addresses. It wasn't limited to one app, either. The setup worked with several well-known wallets, including Trust Wallet, Phantom and OKX Wallet.
A wider wave of Trust Wallet phishing
CZ's warning came shortly after a rise in crypto phishing attempts against wallet users, the outlet said.
On Nov. 3, cybersecurity firm Bitdefender said scammers had started sending fake emails impersonating Trust Wallet, leaning on what Bitdefender described as a recent Binance security breach. The emails suggested Trust Wallet users were also affected and told them to complete what they called a mandatory wallet verification procedure. Anyone who didn't, the messages warned, would be suspended after Nov. 7.
Those messages pointed people to fake verification websites where their wallet credentials or recovery data could be leaked. Bitdefender said the campaign hit users in several countries, including the United States, United Kingdom, Australia, Ireland and South Africa.
Not the first campaign aimed at Trust Wallet users
Earlier in the year, cybersecurity analysts from CYFIRMA identified a separate phishing attack against Trust Wallet users. In that case, according to U.Today's summary of CYFIRMA's findings, the attackers used malicious QR codes on Telegram to go after them.
The delivery's changed across these campaigns (a lookalike website, a fake verification email, a QR code on Telegram), but each one reported so far has targeted people who hold crypto in self-custody wallets.
Frequently asked questions
How did the fake Trust Wallet site try to take users' funds?
According to U.Today, the site asked users to connect their crypto wallets, claiming it needed to review their transfers. It contained JavaScript that tried to scan wallet balances through a backend API to prepare transfers to specific wallet addresses.
Which wallets did the fake Trust Wallet phishing setup work with?
U.Today reported that the attackers' setup worked with several well-known wallets, including Trust Wallet, Phantom and OKX Wallet.
What did the Trust Wallet phishing emails flagged by Bitdefender say?
Bitdefender said the emails impersonated Trust Wallet and told users to complete a mandatory wallet verification procedure, warning they'd be suspended after Nov. 7. The links led to fake verification sites where wallet credentials or recovery data could be leaked.
