Zhao Changpeng ( Changpeng Zhao, CZ ), co-founder of Binance, reminds cryptocurrency users to be wary of a forged Trust Wallet website that attempts to induce visitors to connect to its own wallets; at the same time, there are separate reports indicating that a vulnerability targeting iPhone users may have caused losses of approximately $1.1 million.
Security researcher Anurag discovered this suspicious website and released relevant details on November 5th. He used his Malwarehunter account on X to claim that he had identified malicious JavaScript used for interacting with encrypted wallets.
The website is hosted at trastwallet [.] cam, impersonating Trust Wallet, and offers visitors a service that claims to be able to “review encrypted transfers” before approval.
Zhao Changpeng forwarded the researcher's findings to his followers and reminded users to carefully verify the website addresses.
There are more phishing websites... cam is not com. Be careful! Zhao Changpeng wrote.
At the time this warning appeared, another claim was circulating in the outside world: attackers exploited a vulnerability in iOS's 18.5 devices to steal approximately $1.1 million from Trust Wallet users.
The fake Trust Wallet website supports three mainstream encrypted wallets.
According to the technology discovered by Anurag, this counterfeit website contains JavaScript that is specifically designed for interaction with Trust Wallet, Phantom, and OKX Wallet. This implies that its operators can target users of multiple cryptocurrency wallet services simultaneously.
Once a visitor connects their wallet, the script can scan their encrypted asset balance through the backend application interface and prepare to initiate a transfer to the pre-set recipient address in the code.
The researcher identified that this operation consists of two components: a wallet scanning interface, and an JavaScript integration file responsible for handling wallet connections.
Website screenshots show that the page title is “Review your wallet transfers”, accompanied by a design of a digital payment card, and there is a prominent button urging visitors to connect their wallets.
The page claims that transfers will be sent to the listed recipient addresses, and promotes that the limit for each asset ranges from $1 to $5,000.
On another page, the service is described as an automated asset review process, which also mentions network fees, a limit on single transfers, and wallet authorization.
Although the code contains the components necessary to set up a exchange, Anurag indicates that when he checked the website, the transaction signing function was disabled.
These findings describe a phishing campaign that was capable of identifying wallet balances and preparing for transactions; however, the disabled signature feature limited the actual operations that the researchers were able to execute with the script version they observed.
Trust Wallet Users face separate iOS vulnerability claims
Meanwhile, another warning circulated on November 5th stating that an unidentified attacker exploited a vulnerability in Apple's iOS 18.5 operating system to steal approximately $1.1 million from Trust Wallet users.
This claim was forwarded by the account Emperor.SOL. The account stated that this attack may have extracted the victims' wallet mnemonic phrases from the affected devices.
According to this post, the support team for Trust Wallet has urged users to update their operating systems immediately.
"Update iOS as soon as possible," the account quoted a supporter warning.
The post also included a screenshot of cryptocurrency transfers involving Binance's recharge address and hot wallet, with multiple transactions denominated in USDT.
The transfer amounts shown in the screenshot include 500,000 USDT, 100,000 USDT, and 190,000 USDT, but this screenshot does not prove any connection between these transactions and the so-called iPhone vulnerability.
It is also reported that security researchers have previously discovered attacks targeting older versions of iOS, which are capable of extracting sensitive information from encrypted applications.
In March this year, researchers from Google, Lookout, and iVerify identified a vulnerability exploitation technique used by DarkSword. This technique involves exploiting compromised websites to target vulnerable iPhone systems, which may lead to the exposure of encrypted wallet information.
Apple subsequently fixed these vulnerabilities through software updates and advised users to keep their devices up-to-date.
Trust Wallet has recently faced multiple security incidents
The latest warning came after several recent security complaints regarding the user Trust Wallet.
On November 4th, crypto.news reported that a user complained that 3,830 USDT in their wallet disappeared without any transaction approval or warning.
The user Iaroslav Dubovoi said that he noticed the absence of funds after opening the application, and later found that blockchain records indicated that these cryptocurrencies had been transferred away.
Another user claimed that someone impersonated a support representative on the NEAR Protocol Discord server and emptied his wallet, with the transactions involving various cryptocurrencies.
Trust Wallet Previously, on October 28th, a warning was issued regarding a counterfeit cryptocurrency card website. Researchers discovered that this unauthorized service promoted advanced payment benefits in the name of the company's brand.
This fake service promises a consumption limit of $100,000, a maximum rebate of 8%, and the ability to obtain a card for just $1, but the prerequisite is that visitors must connect their own cryptocurrency wallets.
Claiming to be a member of the Trust Wallet security team, James Bro confirmed that the website is not affiliated with the company and directed users to their official channels.
Even earlier, in December 2025, Trust Wallet encountered a security incident involving its Chrome browser extension version 2.68, which contained malicious code that could expose sensitive wallet information.
Attackers exploited the compromised extensions to steal cryptocurrencies from affected users, with the reported losses ultimately amounting to millions of dollars.
Chao Changpeng, the former CEO of Binance, subsequently stated that affected users would receive compensation during the company's investigation of the incident.
Security concerns regarding older smartphones are not limited to the software of wallet service providers alone. On November 1st, Wang Yishi (the founder of OneKey), reminded that older models of iPhone have security vulnerabilities.
Wang Yishi pointed out that there are hardware vulnerabilities in iPhone 4S to iPhone 11, as well as in the second-generation iPhone and SE. He explained that some of these weaknesses cannot be fixed through regular operating system updates.
He suggests that if cryptocurrency holders have exposed their recovery phrases on devices with vulnerabilities, they should generate new phrases and transfer their assets to newly established secure wallets.
