Trust Wallet Warn users to be cautious of a counterfeit cryptocurrency card website that impersonates their brand. The security team of this company has confirmed that this website, which promotes cryptocurrency payment cards and offers exceptionally generous benefits, is a scam. Users are advised not to connect their wallets to this platform.

This fake website claims to offer a spending limit of $100,000, a maximum rebate of 8%, no KYC identity verification required, as well as airport lounge services, and claims that it only costs $1 to obtain a card.

Security researcher Daniel discovered that the website used the brand logo of Trust Wallet to promote three different card levels, and claimed to have licenses in four countries, after which a warning was issued to the public.

Trust Wallet subsequently clarified that its legitimate products can only be obtained through the official app and website, and reminded users not to approve suspicious wallet connection requests or signatures.

Cryptographic security researcher Daniel posted on X under the username @0xDani, claiming that on October 28th they discovered a counterfeit Trust Wallet card. They pointed out that the relevant website was using the brand of this wallet service provider to promote a payment card that offered a consumption limit of up to $100,000, a maximum cashback of 8%, and came with a range of premium benefits.

The website claims that this card can be used to consume cryptocurrencies anywhere, supporting Apple Pay and Google Pay, without any foreign exchange fees, and no identity verification is required.

James Bro, claiming to represent the security department of Trust Wallet, responded to this warning and confirmed that the website has nothing to do with the company.

Selling high-end benefits under the guise of Trust Wallet cards for just $1

According to the screenshot shared by Daniel, this scam website appears to display a complete set of encrypted card products, including multiple membership levels and a high-end metal card.

Their promotional materials claim that users can obtain a consumption limit of up to $100,000; those who choose the highest-tier card can also enjoy a cashback reward of up to 8%.

The scheme also claims to provide access to airport lounges, zero foreign exchange transaction fees, support for mobile payments, and physical metal cards, with the cost of issuing the cards being only 1 US dollar.

One of the more unusual selling points is that the website claims to require no customer understanding ( KYC ) verification, despite also promoting payment services and claiming to hold licenses from four countries.

The screenshot shared by Daniel shows that the website lists three card levels, namely Lite, Signature, and Metal, all of which carry the name and logo of Trust Wallet.

Entry-level Lite cards claim to offer a maximum rebate of 3%; the Signature version promotes a maximum rebate of 5%, along with zero foreign exchange handling fees and priority support.

At the same time, the Metal level is promoted as offering an 8% rebate, unlimited access to airport lounges, and 24/7 concierge services.

However, this scheme requires users to connect their own encrypted wallets, and Daniel believes that this is precisely the most dangerous part of the scam.

Trust Wallet Security authorities deny any involvement with the website

Regarding the warning for Daniel on X, James Bro confirmed that this website does not belong to Trust Wallet, and directed users to the company's official app and website.

He explained that the legitimate services of Trust Wallet are only provided through official channels, and warned users not to connect to wallets or approve suspicious requests in order to obtain payment cards.

This warning is specifically directed at the process on websites that requires connecting to a wallet; this step is presented as part of obtaining the advertised benefits.

Although the website uses the name Trust Wallet, as well as payment card designs and promotional materials, the response from the security team has been clear: this is not a product authorized by the company.

Relevant posts do not provide confirmed financial losses, affected wallet addresses, or specific information about the operators behind this scam website.

This warning also continues a previous trend where criminals have impersonated Trust Wallet to carry out fraud through unofficial applications and websites.

In June 2024, crypto.news reported that Trust Wallet warned users about counterfeit app versions appearing in the Xiaomi and Amazon app stores.

At that time, the company stated that it had requested the removal of these fraudulent applications and encouraged users to obtain their wallet software through verified download channels.

Phony encryption websites can steal funds through wallet authorization

Scammy crypto websites typically induce users to approve malicious transactions or sign permissions that appear to belong to legitimate services, thereby gaining access to the users' assets.

Simply connecting a wallet does not automatically grant the website the permission to transfer cryptocurrencies. However, attackers can obtain the authority to spend specific tokens through subsequent transaction requests or signatures.

Such permissions may allow attackers to control smart contracts to transfer assets without the victim having to reveal their mnemonic phrases.

In July, an Ethereum user reportedly lost nearly $1 million after approving a malicious transaction that allowed attackers to transfer cryptocurrencies from the affected wallet.

Prior to this, another reported theft case involved approximately $1.65 million; the victim connected to a counterfeit exchange website and signed a malicious smart contract.

Earlier this month, blockchain security company Salus also discovered that unauthorized USDG withdrawals were related to permit signatures, which granted attackers unlimited token expenditure permissions.

According to the company's investigation results, after obtaining authorization, the attackers used these permissions to transfer funds without having to come into contact with the victims' private keys.