Trust Wallet users warned of phishing site trastwallet.cam

画像を読み込み中

Trust Wallet official logo (trustwallet.com/press)

A lookalike domain scans connected wallets and prepares transfers to fixed addresses, as part of a wider campaign aimed at Trust Wallet users

Wed 4 Nov 2026 · 22:59 EST · 4 min read

In Security

Share

A fake Trust Wallet website is asking users to connect their wallets. The real goal is to see what’s inside them and move it elsewhere.

The site sits at trastwallet.cam, a domain built to pass a quick glance. Researchers identified it on November 4, 2026. Two letters separate it from the real thing, and that gap is the whole scam.

How the trastwallet.cam scam works

The pitch is simple. Visitors are prompted to connect their wallets, supposedly so they can review transfers.

Technically, the code relies on a backend API to scan the connected wallet’s balances. It then prepares transfers to fixed recipient addresses. Put plainly, the site figures out what you hold and lines it up to be sent to wallets the scammers control.

The script isn’t picky about its victims either. It supports connections from Trust Wallet, Phantom, and OKX wallets.

There is one small mercy in the findings. At the time of the report, actual transaction signing was disabled on the site.

Signing is the step where a user approves a transaction in their wallet. Without it, the prepared transfers can’t go through.

No confirmed losses or impacts tied directly to trastwallet.cam have been reported. Similar phishing operations in the past, however, have led to significant thefts.

Part of a broader campaign

Trastwallet.cam isn’t operating alone. The findings describe it as one piece of an ongoing campaign targeting Trust Wallet users.

That campaign includes multiple lookalike domains and fake support interfaces.

Security monitoring platform Phishunt.io has documented at least nine active suspicious sites associated with Trust Wallet as of early November.

The news moving money, markets, and the world—before your day starts.

Daily. Free. Join 34,000+ readers across crypto, finance, and policy.

We respect your privacy. Unsubscribe anytime.

The timing adds to the picture. On October 30, 2026, Zürich police issued a warning about phishing emails linked to Trust Wallet.

That’s less than a week before trastwallet.cam surfaced. Emails in the inbox, fake sites in the browser: the scammers appear to be working more than one channel at once.

Spotting the fake

The legitimate Trust Wallet domain is trustwallet.com. The impostor swaps the “u” in trust for an “a” and the “.com” ending for “.cam”.

Trust Wallet has repeatedly warned users against sharing seed phrases on third-party sites. A seed phrase is the master key to a self-custody wallet. Anyone who has it controls the funds, no password reset required.

The trastwallet.cam setup shows that a seed phrase isn’t the only thing at risk, though. Simply connecting a wallet lets the site scan balances and stage transfers. The danger lies in what a user might approve next.

A few habits do most of the heavy lifting here:

Check the URL character by character. Bookmark trustwallet.com and use the bookmark instead of links from emails, messages, or ads.

Don’t connect your wallet to unofficial platforms. A request to connect in order to “review transfers” should raise eyebrows, not trigger a click.

Read every signing request. If a wallet pops up asking to approve a transfer you didn’t initiate, the answer is no.

Never type your seed phrase into a website. Not for support, not for verification, not for anything.

What this means for self-custody users

Self-custody wallets sell a clear promise: you hold your own keys, and nobody can freeze or seize your funds. The flip side is that nobody can reverse a bad transaction either.

The multi-wallet support in the trastwallet.cam code matters here. By accepting Trust Wallet, Phantom, and OKX connections, the operators widen their net beyond a single brand’s user base.

The disabled signing is worth watching too. A site with the draining logic built but switched off is a loaded tool, not a harmless one.

The broader pattern is the bigger concern. At least nine suspicious Trust Wallet-themed sites, fake support pages, and police-flagged phishing emails all land in the same narrow window.

For individual users, the practical stakes are more immediate. The difference between trustwallet.com and trastwallet.cam is two characters, and right now that’s about the width of the safety margin.

Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.