Trust Wallet security team has sounded the alarm after a convincing fake website began promoting a “premium” crypto payment card that offers wildly generous perks — and asks users to connect their wallets to claim them.
What was flagged
- On October 28, crypto security researcher Daniel (@0xDani on X) shared screenshots of a fraudulent site that used Trust Wallet branding to advertise a crypto card with a $100,000 spending limit, up to 8% cashback, zero FX fees, Apple Pay/Google Pay support, airport lounge access, and a physical metal card — all for a $1 issuance fee and allegedly with no KYC.
- The site displayed three tiers (Lite, Signature, Metal). According to the screenshots, Lite promised up to 3% cashback; Signature up to 5% plus zero FX fees and priority support; Metal offered 8% cashback, unlimited lounge access and 24/7 concierge.
Why it’s dangerous
- The scam’s critical hook was a wallet-connection requirement: users were prompted to link their crypto wallets to “activate” the card. Trust Wallet’s security representative, James Bro, confirmed the site is not affiliated with Trust Wallet and warned users not to connect or approve any suspicious requests.
- While merely connecting a wallet doesn’t instantly transfer funds, malicious sites can prompt users to approve transactions or sign permit messages that grant smart contracts permission to move tokens. Attackers frequently exploit these approvals to drain wallets without needing the recovery phrase.
Context and precedent
- There were no confirmed losses, affected wallet addresses, or details about the operators posted alongside the warnings.
- The alert follows earlier impersonation attempts: in June 2024 Trust Wallet warned about counterfeit versions of its app appearing on Xiaomi and Amazon app stores and urged users to download software only from verified sources.
- High-value thefts tied to malicious approvals have occurred this year: in July, one Ethereum user reportedly lost nearly $1 million after approving a malicious transaction; another victim lost about $1.65 million after connecting to a fraudulent exchange site and signing a malicious smart contract. Blockchain security firm Salus also recently linked unauthorized USDG withdrawals to permit signatures that gave attackers unlimited token spending permissions.
How to stay safe
- Don’t connect your wallet to unverified sites. If you’re unsure, close the page and open the wallet app directly or visit the official website from a bookmarked link.
- Never sign transactions or approvals unless you know exactly what they do. Watch for vague approval requests that grant “infinite” or broad permissions.
- Use allowance-revoking tools and permission managers to check and revoke suspicious approvals.
- Only install wallet apps from official sources and verify domains before entering any sensitive info.
Trust Wallet’s security team has directed users to its official channels for legitimate offerings. If you see similar offers touting unrealistic benefits, treat them as red flags and report them to the wallet provider and community security channels.
What was flagged
- On October 28, crypto security researcher Daniel (@0xDani on X) shared screenshots of a fraudulent site that used Trust Wallet branding to advertise a crypto card with a $100,000 spending limit, up to 8% cashback, zero FX fees, Apple Pay/Google Pay support, airport lounge access, and a physical metal card — all for a $1 issuance fee and allegedly with no KYC.
- The site displayed three tiers (Lite, Signature, Metal). According to the screenshots, Lite promised up to 3% cashback; Signature up to 5% plus zero FX fees and priority support; Metal offered 8% cashback, unlimited lounge access and 24/7 concierge.
Why it’s dangerous
- The scam’s critical hook was a wallet-connection requirement: users were prompted to link their crypto wallets to “activate” the card. Trust Wallet’s security representative, James Bro, confirmed the site is not affiliated with Trust Wallet and warned users not to connect or approve any suspicious requests.
- While merely connecting a wallet doesn’t instantly transfer funds, malicious sites can prompt users to approve transactions or sign permit messages that grant smart contracts permission to move tokens. Attackers frequently exploit these approvals to drain wallets without needing the recovery phrase.
Context and precedent
- There were no confirmed losses, affected wallet addresses, or details about the operators posted alongside the warnings.
- The alert follows earlier impersonation attempts: in June 2024 Trust Wallet warned about counterfeit versions of its app appearing on Xiaomi and Amazon app stores and urged users to download software only from verified sources.
- High-value thefts tied to malicious approvals have occurred this year: in July, one Ethereum user reportedly lost nearly $1 million after approving a malicious transaction; another victim lost about $1.65 million after connecting to a fraudulent exchange site and signing a malicious smart contract. Blockchain security firm Salus also recently linked unauthorized USDG withdrawals to permit signatures that gave attackers unlimited token spending permissions.
How to stay safe
- Don’t connect your wallet to unverified sites. If you’re unsure, close the page and open the wallet app directly or visit the official website from a bookmarked link.
- Never sign transactions or approvals unless you know exactly what they do. Watch for vague approval requests that grant “infinite” or broad permissions.
- Use allowance-revoking tools and permission managers to check and revoke suspicious approvals.
- Only install wallet apps from official sources and verify domains before entering any sensitive info.
Trust Wallet’s security team has directed users to its official channels for legitimate offerings. If you see similar offers touting unrealistic benefits, treat them as red flags and report them to the wallet provider and community security channels.