Trust Wallet warns users of fraudulent crypto card website

What happened

A fraudulent website is using Trust Wallet's branding and name to market a cryptocurrency payment card with exceptionally generous terms, according to warnings from both the wallet provider and security researchers. The fake site advertises three card tiers, Lite, Signature, and Metal, each prominently displaying Trust Wallet's logo and promising rewards ranging from 3% to 8% cashback. The offer also includes benefits such as airport lounge access, zero foreign exchange fees, support for Apple Pay and Google Pay, and a remarkably low $1 card issuance fee.

Crypto security researcher Daniel, known on X as @0xDani, initially flagged the fraudulent site on October 28. Screenshots shared by Daniel showed that the website claimed to hold licenses in four countries and advertised a $100,000 spending limit alongside no Know Your Customer verification requirements, an unusual combination for a payment service platform. The scheme's critical element was a requirement that prospective users connect their cryptocurrency wallets to access the advertised card benefits.

James Bro, representing Trust Wallet's security team, quickly responded to confirm that the website has no connection to the company. He directed users to only use Trust Wallet's official application and website for legitimate offerings and warned against approving wallet connections or signatures from suspicious sources related to payment card offers.

Why it matters

The fraudulent website represents a sophisticated social engineering attack that exploits the appeal of premium financial services to manipulate users into exposing their cryptocurrency holdings to attackers. While connecting a wallet to a website does not automatically grant access to funds, it creates an opening for attackers to request transaction approvals or signatures that can grant unauthorized spending permissions. Once such permissions are obtained through deceptive transaction requests, attackers can use them to transfer tokens from victims' wallets without requiring the victims' recovery phrases or private keys. Recent high-profile incidents illustrate the severity of this threat: an Ethereum user lost nearly $1 million in July after approving a malicious transaction, while another victim lost approximately $1.65 million after connecting to a fraudulent exchange website and signing a malicious smart contract. Earlier this month, blockchain security firm Salus identified similar tactics in unauthorized USDG withdrawals, where attackers leveraged permit signatures to grant themselves unlimited token spending rights.

Background

Trust Wallet has faced repeated impersonation attempts by scammers. In June 2024, the company warned users about counterfeit versions of its application appearing on the Xiaomi and Amazon app stores, requesting their removal from those platforms. The pattern of targeting Trust Wallet specifically may stem from the wallet's popularity and widespread user base, making it an attractive brand for attackers seeking to establish credibility with potential victims.

What to watch

Users should remain vigilant about wallet connection requests from any unfamiliar sources, particularly those offering unusually attractive financial benefits. The combination of no identity verification requirements with promises of high spending limits and generous rewards should serve as a red flag. Trust Wallet continues to advise users to verify all services through its official channels and to never approve wallet connections or transaction signatures without independent verification of the requesting entity's legitimacy.

Questions readers ask