TLDR
- Trust Wallet’s security team confirmed that a website promoting a crypto payment card is fake and not linked to the company.
- The site promised a $100,000 spending limit, up to 8% cashback, no KYC checks, and card issuance for just $1.
- Security researcher Daniel, known as @0xDani on X, flagged the fake site on October 28.
- The scheme required users to connect their crypto wallets, which can lead to harmful transaction approvals.
- Trust Wallet urged users to rely only on its official app and website.
Trust Wallet has warned users about a fake website offering a crypto payment card under its name. The company’s security team confirmed the site is not linked to Trust Wallet.
Crypto security researcher Daniel, known as @0xDani on X, flagged the website on October 28. The site used Trust Wallet’s logo and branding to promote the card.
The website said the card could be used to spend crypto anywhere. It listed Apple Pay and Google Pay support, zero foreign exchange fees, and no identity checks.
Fake Card Offered Premium Perks for $1
Screenshots shared by Daniel showed three card tiers called Lite, Signature, and Metal. Each carried the Trust Wallet name and logo.
The Lite card promised up to 3% cashback. The Signature card offered up to 5% cashback, zero foreign exchange fees, and priority support.
The Metal tier listed 8% cashback, unlimited airport lounge access, and round-the-clock concierge service. The site also promoted a $100,000 spending limit and a $1 card issuance fee.
The website claimed to hold licenses in four countries. It also said users would not need to complete Know Your Customer checks, known as KYC.
To get the card, users had to connect their crypto wallets. Daniel identified this step as the dangerous part of the scheme.
Trust Wallet Denies Any Link to the Site
James Bro, who said he speaks for Trust Wallet’s security team, replied to Daniel’s post on X. He confirmed the website does not belong to the company.
He said real Trust Wallet products are only available through its official app and website. He warned users not to connect their wallets or approve suspicious requests to get a card.
The posts did not report any confirmed losses or affected wallet addresses. No details were shared about who runs the site.
Scammers have used Trust Wallet’s name before. In June 2024, the company warned about fake versions of its app on the Xiaomi and Amazon app stores and asked for their removal.
Connecting a wallet to a website does not on its own let the site move funds. However, attackers can use later transaction requests or signatures to gain spending rights over certain tokens.
These permissions can let an attacker’s smart contract move assets without the victim sharing a recovery phrase. In July, an Ethereum user reportedly lost nearly $1 million after approving a malicious transaction.
Before that, another victim reportedly lost about $1.65 million. That person connected to a fake exchange website and signed a malicious smart contract.
Earlier this month, blockchain security firm Salus linked unauthorized USDG withdrawals to permit signatures. The firm said these gave attackers unlimited token spending rights, letting them move funds without the victims’ private keys.
Trust Wallet’s security team is directing users to its official app and website for any card offers. Users are advised not to approve wallet connections or signatures from unknown sites.
