Changpeng Zhao Warns About Cryptocurrency Phishing Scam

Binance co-founder Changpeng Zhao (CZ) warned on November 5, 2026, about a website impersonating Trust Wallet, which offers to connect a crypto wallet supposedly for transaction verification. Researchers found code for preparing transactions, but no confirmed thefts through this resource have been reported yet.

How the Fake Page Works

Scammers used a domain that visually resembles the official Trust Wallet address: they changed one letter in the name and replaced the .com domain zone with .cam. This tactic relies on inattentive address verification.

According to researchers, the page's JavaScript code supported connections to Trust Wallet, Phantom, and OKX Wallet. Through the API, it could check balances and prepare transactions to specified addresses. At the time of the check, the transaction signing function was disabled. There is no data on successful thefts through this site.

It is important to distinguish between connecting a wallet and granting permission to spend assets. The connection itself does not grant the right to transfer coins. The threat arises if the user signs a malicious transaction, grants permission to a smart contract, or discloses the secret recovery phrase.

Scammers Exploit Binance Hack

On November 3, Bitdefender reported another phishing campaign. The attackers posed as Trust Wallet and claimed that a recent Binance hack affected the wallet's owners. The emails demanded mandatory verification and threatened blocking after November 7.

Such messages were received by users in the USA, UK, Australia, Ireland, and South Africa. The links led to fake pages where visitors could be convinced to disclose wallet recovery data or confirm dangerous actions. The companies are not associated with the campaign.

Previously, CYFIRMA described a separate scheme with QR codes in Telegram: under the guise of sending USDT, scammers sought permission to spend tokens. The connection of this campaign with the new site has not been established.

How to Reduce Risk

It is safer to open Trust Wallet through a saved official address or application, rather than a link from an email. Do not enter the seed phrase on third-party pages or sign unclear requests. In case of a suspicious connection, check active token permissions and revoke unnecessary ones through the wallet's own tools. This is more important than any urgent "verification" demands.