Trust Wallet’s security team has confirmed that a website advertising a cryptocurrency payment card with unusually generous benefits is fraudulent and has warned users against connecting their wallets to the platform. Security researcher Daniel, known as @0xDani on X, flagged the fake Trust Wallet card on October 28, pointing to a site that used the wallet provider’s branding to promote a payment card with a $100,000 spending limit, cashback rewards of up to 8%, and several premium benefits.
The fraudulent offer included no KYC requirements, zero foreign exchange fees, Apple Pay and Google Pay support, airport lounge access, a premium metal card, and an issuance fee of just $1. Daniel shared screenshots showing three card tiers — Lite, Signature, and Metal — each carrying the Trust Wallet name and logo. The Lite tier promised up to 3% cashback, Signature advertised up to 5% cashback with priority support, and Metal promoted 8% cashback, unlimited lounge access, and 24/7 concierge services. However, the website required users to connect their cryptocurrency wallets, which Daniel identified as the dangerous part of the scheme.
James Bro, speaking for Trust Wallet’s security team, responded to the warning and confirmed that the website was not associated with the company. He directed users to Trust Wallet’s official application and website, warning them against approving suspicious wallet connection requests or signatures. No confirmed financial losses, affected wallet addresses, or details about the operators were disclosed. Trust Wallet previously warned about counterfeit versions of its application on Xiaomi and Amazon app stores in June 2024.
In a separate incident, Scam Sniffer reported that a cryptocurrency user lost approximately $50,000 in USDT to an address-poisoning attack on Ethereum. The fraudulent address matched the intended recipient’s first four and last six characters. Address poisoning works by planting a lookalike address in a user’s transaction history, often through a zero-value or dust transfer. When the victim later copies the wrong destination for a payment, funds are sent to the attacker. MetaMask’s security guidance notes that shortened address displays can conceal the difference because the opening and closing characters look familiar while the middle differs.
Earlier cases highlighted the same tactic. In August, a user lost approximately 100,000 USDT after selecting an imitation address planted 66 days earlier, according to Cyvers Alerts. Another case in December 2025 involved a trader who transferred 49,999,950 USDT to a fraudulent destination after first sending a 50 USDT test payment. SlowMist monitoring cited in coverage said the funds were converted into ETH, distributed across wallets, and partially moved through Tornado Cash. The victim later offered a $1 million bounty for the return of 98% of the funds within 48 hours. Binance co-founder Changpeng Zhao has also criticized transaction-history spam and called on blockchain explorers to filter malicious entries, while Ledger warned about dummy transactions designed to make users believe they had previously sent funds to an attacker’s address.
