Trust Wallet users warned over phishing site and $1.1M claim

On November 5, security researcher Anurag confirmed a fake Trust Wallet website contained code designed to scan balances and prepare transfers, while Emperor.SOL separately alleged $1.1 million in iOS 18.5 losses.

The reported phishing site and the alleged iOS exploit have no established connection. Anurag found transaction signing disabled when he examined the site’s code, limiting what that version could execute.

One screen on the fake site was titled “Review your wallet transfers.” It showed a digital payment card design and a button asking visitors to connect their wallets.

The page claimed that transfers would go to listed receiving addresses. It advertised a per-asset limit ranging from $1 to $5,000. Another screen described an automatic asset-review service and referenced network fees, separate transfer limits and wallet authorization.

After a visitor connected, a backend application programming interface could scan the wallet’s balances, while the code prepared transfers to recipient addresses preset in the script.

Binance co-founder Changpeng Zhao shared the findings with his followers and urged users to pay close attention to website addresses: “More phishing websites out there… .cam is not .com. Be careful!”

Anurag, who operates the Malwarehunter account on X, identified the suspicious domain on November 5 and published details of its malicious JavaScript. He found two components: a wallet-scanning endpoint and an integration file that handled wallet connections. The code supported Trust Wallet, Phantom and OKX Wallet.

The separate iOS allegation

Emperor.SOL alleged that an unidentified attacker stole roughly $1.1 million from Trust Wallet users by exploiting devices running iOS 18.5. The account said the attack could extract victims’ wallet seed phrases. Trust Wallet support, according to the post, urged users to update their operating systems immediately: “Update iOS as soon as possible.”

A screenshot accompanying the post showed transfers involving Binance deposit addresses and hot wallets, with several transactions denominated in USDT. The displayed amounts included 500,000 USDT, 100,000 USDT and 190,000 USDT.

The screenshot did not establish how those transactions connected to the alleged iPhone exploit. That leaves the theft claim separate from the observed phishing code and its disabled signing function.

Separately, in March, researchers from Google, Lookout and iVerify identified the DarkSword exploit. It targeted vulnerable iPhones through compromised websites and could expose cryptocurrency wallet information. Apple subsequently addressed the vulnerabilities through software updates and advised users to keep their devices updated.

Trust Wallet’s recent security record

Trust Wallet has faced several distinct security complaints and incidents. On November 4, crypto.news reported that Iaroslav Dubovoi found 3,830 USDT missing after opening the application. He said the funds disappeared without any transaction approval or warning, and later found blockchain records showing the transfer.

Another user said an impersonator of a support representative on NEAR Protocol’s Discord server had drained his wallet. The reported transactions involved several cryptocurrencies.

On October 28, Trust Wallet warned about a fraudulent cryptocurrency card website operating under the company’s branding. It offered a $100,000 spending limit, cashback of up to 8% and card issuance for $1, but required visitors to connect their wallets. James Bro, who identified himself as a member of Trust Wallet’s security team, confirmed that the site was not affiliated with the company and directed users to official channels.

In December 2025, version 2.68 of Trust Wallet’s browser extension contained malicious code capable of exposing sensitive wallet information. Attackers used the compromised extension to steal cryptocurrency, and reported losses eventually reached millions of dollars. Zhao said affected users would receive compensation while the company investigated.

What changes for wallet security?

OneKey founder Yishi Wang warned on November 1 about hardware vulnerabilities affecting older iPhones. His list covered the iPhone 4S through the iPhone 11 and the second-generation iPhone SE. He said some weaknesses could not be corrected through ordinary operating-system updates.

His remedy was direct. Users who exposed recovery phrases on vulnerable devices should generate new phrases and move their assets to newly secured wallets.

What does this change for Trust Wallet users? The immediate response is to avoid the reported .cam domain, follow the iOS update advice quoted in the Emperor.SOL post and replace recovery phrases exposed on vulnerable hardware.

For now, the warnings set no remediation deadline. The next checkpoint is a technical disclosure from Trust Wallet or Apple that could confirm, or refute, the iOS 18.5 claim.