Changpeng Zhao warns: fake Trust Wallet phishing sites mostl
On November 5, 2026, Zhao Changpeng reposted a security researcher's disclosure on X and reminded users: the phishing site impersonating Trust Wallet uses a .cam rather than a .com domain. According to reports, the site lures users into connecting their wallets; its script supports Trust Wallet, Phantom and OKX, can scan wallet balances and is prepared to transfer funds to a fixed address.
Event Timeline
- [11-05 03:59] Zhao Changpeng warns against a phishing site impersonating Trust Wallet, urging users to distinguish the .cam from the .com domain (PANews)
- [11-05 04:03] CZ: Beware of wallet-impersonating phishing sites, note the difference between .cam and .com domains (Odaily Planet Daily)
Background and Impact
At 03:59 on November 5, 2026, PANews reported that, in response to a phishing site impersonating Trust Wallet disclosed by a security researcher, Zhao Changpeng reposted the tweet on X and reminded users: the phishing site uses a ".cam" domain, not ".com", so it must be carefully distinguished. About four minutes later, at 04:03, Odaily Planet Daily also reported the reminder, likewise stressing that ".cam" and ".com" are different domains.
According to the reports from both outlets, the site lures users into connecting their wallets; its JS script supports three types of wallets — Trust Wallet, Phantom and OKX — and scans wallet balances through a backend API, preparing to transfer funds to a fixed address. The two sources are not entirely consistent in their details: Odaily Planet Daily, citing a post by security researcher Anurag, said the site lures users into connecting their crypto wallets under the pretext of reviewing a transfer, and that the transaction signing function was disabled at the time; the PANews report did not mention the "reviewing a transfer" pretext, nor the status of the signing function, stating only that the site lures users into connecting their wallets. This discrepancy is not further explained in the available materials.
Based on the information disclosed, the described attack chain centers on three stages: luring users into connecting their wallets, scanning balances through a backend API, and preparing to transfer funds to a fixed address. The script is compatible with all three wallets — Trust Wallet, Phantom and OKX — indicating that the attackers did not limit their targets to a single wallet brand. Zhao Changpeng's reminder focuses on the domain level: the top-level domain used by the phishing site is ".cam", which differs from the commonly official ".com" by only one suffix, making it easy for users to overlook on mobile devices or when clicking links quickly.
For users, the direct risk point in this incident lies in the act of "connecting a wallet" itself, while descriptions appearing in public information such as "preparing to transfer funds to a fixed address" and "the transaction signing function is disabled" point to the script's current capabilities and limitations rather than losses that have already occurred; neither outlet provided a loss amount or the number of affected users. Wallet and exchange brands have long been impersonation targets for phishing sites, and in addition to checking domain suffixes, users should be equally cautious when searching for third-party pages related to fees: for example, common terms such as "OKX fee rebate", "OKX trading rebate", "Huobi fee rebate", "Huobi trading rebate" and "Zhima Kaimen fee rebate" often point to unofficial sources, and users should confirm the domain matches the official one before following the redirect. As for whether the domain involved has been dealt with and whether the signing function will later be restored, the available materials do not yet cover this and it remains to be seen.
FAQ
### Which wallet users will this phishing site affect?
According to reports from both outlets, the site's script supports three wallets — Trust Wallet, Phantom and OKX — and lures users into connecting their wallets, scans balances through a backend API, and prepares to transfer funds to a fixed address. The post cited by Odaily Planet Daily said the transaction signing function was disabled at the time.
### How can ordinary users quickly tell a real site from a fake one?
The public reminders so far focus on the domain suffix: the phishing site uses ".cam" while the official one is ".com", and Zhao Changpeng stressed that the two are different domains. As for other distinguishing details such as page design and customer-service scripts, neither outlet's report elaborated.
### What points should be watched going forward?
Neither outlet mentioned whether the domain involved has been shut down or who would handle it, nor whether the signing function will be re-enabled. Odaily Planet Daily's wording was that the function was disabled "at the time"; subsequent changes remain to be disclosed.