Trust Wallet’s security team has confirmed that a website advertising a cryptocurrency payment card with unusually generous benefits is fraudulent and has warned users against connecting their wallets to the platform.
Summary
- Trust Wallet’s security team has confirmed that a website advertising a cryptocurrency payment card with premium benefits is fraudulent and has warned users against connecting their wallets.
- The fake website promises a $100,000 spending limit, up to 8% cashback, no KYC requirements, and airport lounge access, with card issuance advertised for just $1.
- Security researcher Daniel flagged the website after discovering that it used Trust Wallet’s branding to promote three card tiers and claimed to hold licenses in four countries.
- Trust Wallet has clarified that its legitimate offerings are available through its official application and website, warning users against approving suspicious wallet connection requests or signatures.
Crypto security researcher Daniel, known as @0xDani on X, flagged the fake Trust Wallet card in a post on October 28, pointing to a website that used the wallet provider’s branding to promote a payment card with a $100,000 spending limit, cashback rewards of up to 8%, and several premium benefits.
The website advertised the card as a way to spend cryptocurrency anywhere, with support for Apple Pay and Google Pay, zero foreign exchange fees, and no identity verification requirements.
James Bro, who identified himself as speaking for Trust Wallet’s security team, responded to the warning and confirmed that the website was not associated with the company.
Fake Trust Wallet card promises premium benefits for $1
According to Daniel’s screenshots, the fraudulent website presented what appeared to be a fully developed cryptocurrency card offering, complete with several membership tiers and a premium metal card.
Its promotional material advertised a spending limit of up to $100,000, alongside cashback rewards reaching 8% for users choosing the highest card tier.
The offer included airport lounge access, zero foreign exchange fees, support for mobile payment services, and a physical metal card, all while claiming that users would only need to pay $1 to have their card issued.
One of the more unusual features was the promise of no Know Your Customer verification, commonly called KYC, despite the website advertising payment services and claiming to hold licenses in four countries.
Screenshots shared by Daniel showed three card tiers, including Lite, Signature, and Metal, each carrying the Trust Wallet name and logo.
The entry-level Lite card promised up to 3% cashback, while the Signature version advertised rewards reaching 5%, along with zero foreign exchange fees and priority support.
Meanwhile, the Metal tier was promoted with 8% cashback, unlimited airport lounge access, and round-the-clock concierge services.
However, the offer required users to connect their cryptocurrency wallets, which Daniel identified as the dangerous part of the scheme.
Trust Wallet security team denies connection to the website
Responding to Daniel’s warning on X, James Bro confirmed that the website did not belong to Trust Wallet and directed users to the company’s official application and website.
He explained that legitimate Trust Wallet offerings are available through its official channels and warned users against connecting their wallets or approving suspicious requests to obtain a payment card.
The warning specifically addressed the website’s wallet connection requirement, which was presented as part of the process for accessing the advertised benefits.
Although the website used Trust Wallet’s name, payment card designs, and promotional material, the security team’s response established that the offer was not an authorized company product.
No confirmed financial losses, affected wallet addresses, or details about the operators behind the fraudulent website were provided in the posts.
The warning follows earlier instances of criminals impersonating Trust Wallet through unofficial applications and websites.
In June 2024, crypto.news reported that Trust Wallet had warned users about counterfeit versions of its application appearing on Xiaomi and Amazon app stores.
At the time, the company said it had requested the removal of the fraudulent applications and encouraged users to obtain its wallet software through verified download channels.
Fake crypto websites can use wallet approvals to steal funds
Fraudulent cryptocurrency websites commonly attempt to obtain access to users’ assets by persuading them to approve malicious transactions or sign permissions that appear to be part of a legitimate service.
A wallet connection alone does not automatically give a website permission to transfer cryptocurrency. However, attackers can use subsequent transaction requests or signatures to obtain spending permissions over specific tokens.
Such permissions can allow an attacker-controlled smart contract to transfer assets without requiring the victim to reveal their recovery phrase.
In July, an Ethereum user reportedly lost nearly $1 million after approving a malicious transaction that allowed attackers to move cryptocurrency from the affected wallet.
The incident followed another reported theft involving approximately $1.65 million, where a victim connected to a fraudulent exchange website and signed a malicious smart contract.
Similar methods were identified earlier this month when blockchain security firm Salus linked unauthorized USDG withdrawals to permit signatures that granted attackers unlimited token spending permissions.
According to the firm’s findings, attackers used those permissions to transfer funds after obtaining authorization, without needing access to the victims’ private keys.
