The fake Trust Wallet website trastwallet.cam is designed to trick users into connecting wallets to review transfers, while JavaScript scans balances through a backend API and prepares transfers to specific recipient addresses. The domain replaces the legitimate site’s “u” with “a” and uses .cam instead of .com, a change that can be missed by users inspecting the address casually. Binance co-founder Changpeng Zhao warned about the operation, which works with Trust Wallet, Phantom and OKX Wallet. Transaction signing was disabled when researchers identified the site on November 4, 2026, and no confirmed losses tied directly to the domain had been reported. The warning came amid broader Trust Wallet phishing activity, including fake emails linked to a recent Binance security breach, malicious QR codes circulated on Telegram and multiple lookalike domains. Bitdefender said one campaign targeted users in the United States, United Kingdom, Australia, Ireland and South Africa with mandatory verification demands designed to capture wallet credentials or recovery data.