Binance co-founder Changpeng Zhao has warned cryptocurrency users about a fraudulent Trust Wallet website designed to trick visitors into connecting their wallets, as separate reports have raised concerns about a $1.1 million exploit targeting iPhone users.
<div id="cn-block-summary-block_eefc66fd338ac258e501810a808e7827" class="cn-block-summary">
 <div class="cn-block-summary__nav tabs">Summary
 </div>
 <div class="cn-block-summary__content">
 <ul>
 <li>Binance co-founder Changpeng Zhao warned users about a fake Trust Wallet website that tricks visitors into connecting their cryptocurrency wallets under the pretext of reviewing transfers.</li>
 <li>Security researcher Anurag found that the malicious website supports Trust Wallet, Phantom, and OKX Wallet and contains code capable of scanning wallet balances and preparing transfers to preset addresses.</li>
 <li>The researcher said transaction signing was disabled when the website was examined, although its JavaScript contained the components needed to prepare cryptocurrency transfers.</li>
 <li>Separate reports alleged that an attacker had stolen approximately $1.1 million from Trust Wallet users through an exploit affecting devices running iOS 18.5, with users urged to update their operating systems.</li>
 </ul>
 </div>
</div>
Security researcher Anurag, who operates the Malwarehunter account on X, identified the suspicious website on November 5 and published details of the malicious JavaScript used to interact with cryptocurrency wallets.
The website, hosted at trastwallet[.]cam, impersonates Trust Wallet and presents visitors with a service that supposedly allows them to review cryptocurrency transfers before approving them.
Zhao <a href="https://x.com/cz_binance/status/2118190442894512420?a=i1f0z5u6U_Y9COKtNyc&amp;s=20" rel="noopener noreferrer nofollow">shared</a> the researcher’s findings with his followers and warned users to pay close attention to website addresses.
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
 “More phishing websites out there… .cam is not .com. Be careful!” Zhao wrote.
</blockquote>
The warning comes amid separate claims that attackers have stolen approximately $1.1 million from Trust Wallet users through an exploit affecting devices running iOS 18.5.
<h2 class="wp-block-heading" id="strong-fake-trust-wallet-website-supports-three-major-crypto-wallets-strong">Fake Trust Wallet website supports three major crypto wallets</h2>
According to Anurag’s technical findings, the fraudulent website contains JavaScript designed to interact with Trust Wallet, Phantom, and OKX Wallet, allowing its operators to target users across multiple cryptocurrency wallet services.
<figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x">
 <div class="wp-block-embed__wrapper">
 <blockquote class="twitter-tweet">
 🚨 Fake Trust Wallet Site A fake Trust Wallet site tricks users into connecting their crypto wallets under the pretext of reviewing transfers. The JS supports Trust Wallet, Phantom &amp; OKX, scans wallet balances via a backend API, and prepares transfers to fixed recipient… <a href="https://t.co/EitL5ftnpc" rel="noopener noreferrer nofollow">pic.twitter.com/EitL5ftnpc</a>— Anurag (@Malwarehunterr) <a href="https://x.com/Malwarehunterr/status/2118078249809162597?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">November 4, 2026</a>
 </blockquote>
 </div>
</figure>
Once visitors connect their wallets, the script can scan their cryptocurrency balances through a backend application programming interface and prepare transfers to recipient addresses already specified in the code.
The researcher identified two components of the operation, including a wallet scanning endpoint and a JavaScript integration file responsible for handling wallet connections.
Screenshots of the website show a page titled “Review your wallet transfers,” accompanied by a digital payment card design and a prominent button asking visitors to connect their wallets.
You might also like: <a href="https://crypto.news/trust-wallet-warns-of-fake-crypto-card-website-targeting-users/" rel="noopener noreferrer nofollow"> Trust Wallet warns of fake crypto card website targeting users </a>
The page claims that transfers will be sent to listed receiving addresses and advertises a per-asset limit ranging from $1 to $5,000.
Another screen describes the service as an automatic asset review process, with separate references to network fees, independent transfer limits, and wallet authorization.
Although the code contains the components needed to prepare transactions, Anurag reported that transaction signing was disabled when he examined the website.
The findings describe a phishing operation capable of identifying wallet balances and preparing transactions, while the disabled signing function limits what the identified version of the script could execute.
<h2 class="wp-block-heading" id="strong-trust-wallet-users-face-separate-ios-exploit-claims-strong">Trust Wallet users face separate iOS exploit claims</h2>
Meanwhile, another warning circulating on November 5 alleged that an unidentified attacker had stolen roughly $1.1 million from Trust Wallet users through an exploit targeting Apple’s iOS 18.5 operating system.
The claim was shared by the X account Emperor.SOL, which said the attack could extract victims’ wallet seed phrases from affected devices.
According to the post, Trust Wallet support had urged users to update their operating systems immediately.
“Update iOS as soon as possible,” the account quoted the support warning as saying.
The post included a screenshot of cryptocurrency transfers involving Binance deposit addresses and hot wallets, with several transactions denominated in USDT.
The displayed transfers included amounts of 500,000 USDT, 100,000 USDT, and 190,000 USDT, although the screenshot did not establish how the transactions were connected to the alleged iPhone exploit.
Separately, security researchers have previously identified attacks against older iOS versions that can extract sensitive information from cryptocurrency applications.
In March, researchers from Google, Lookout, and iVerify identified the DarkSword exploit, which targeted vulnerable iPhones through compromised websites and could expose cryptocurrency wallet information.
Apple subsequently addressed the vulnerabilities through software updates and advised users to keep their devices updated.
<h2 class="wp-block-heading" id="strong-trust-wallet-has-faced-multiple-security-incidents-strong">Trust Wallet has faced multiple security incidents</h2>
The latest warnings follow several security complaints involving Trust Wallet users in recent weeks.
On November 4, crypto.news <a href="https://crypto.news/trust-wallet-user-reports-losing-funds-without-approving-transaction/" rel="noopener noreferrer nofollow">reported a user’s complaint</a> that 3,830 USDT had disappeared from his wallet without any transaction approval or warning.
The user, Iaroslav Dubovoi, said he discovered the missing funds after opening the application and later found blockchain records showing that the cryptocurrency had been transferred.
Another user claimed that someone impersonating a support representative on NEAR Protocol’s Discord server had drained his wallet, with the reported transactions involving several cryptocurrencies.
Trust Wallet had previously <a href="https://crypto.news/trust-wallet-warns-of-fake-crypto-card-website-targeting-users/" rel="noopener noreferrer nofollow">warned about a fraudulent</a> cryptocurrency card website on October 28 after researchers discovered an unauthorized service advertising premium payment benefits under the company’s branding.
The fake service promised a $100,000 spending limit, cashback rewards of up to 8%, and card issuance for just $1, but required visitors to connect their cryptocurrency wallets.
James Bro, who identified himself as a member of Trust Wallet’s security team, confirmed that the website was not affiliated with the company and directed users to its official channels.
Earlier, in December 2025, Trust Wallet suffered a security incident involving version 2.68 of its Chrome browser extension, which contained malicious code capable of exposing sensitive wallet information.
Attackers used the compromised extension to steal cryptocurrency from affected users, with reported losses eventually reaching millions of dollars.
Former Binance CEO Zhao subsequently said affected users would receive compensation while the company investigated the incident.
Security concerns involving older smartphones have continued beyond the wallet provider’s own software. On November 1, OneKey founder Yishi Wang <a href="https://crypto.news/onekey-founder-old-iphone-crypto-seed-phrase-risks/" rel="noopener noreferrer nofollow">warned about security weaknesses</a> affecting older iPhone models.
Wang identified hardware vulnerabilities affecting devices from the iPhone 4S through the iPhone 11 and second-generation iPhone SE, explaining that certain weaknesses cannot be corrected through ordinary operating system updates.
He advised cryptocurrency holders who had exposed their recovery phrases on vulnerable devices to generate new phrases and move their assets to newly secured wallets.
Read more: <a href="https://crypto.news/why-is-bitcoin-price-up-today-etf-inflows-btc-80000/" rel="noopener noreferrer nofollow"> Why is Bitcoin price up today, November 5? </a>

CZ warns Trust Wallet users of fake website as $1.1M exploit emerges

Table of Contents

crypto.news

Other articles published on Nov 5, 2026

Join our free newsletter for daily crypto updates!