Headline: CZ flags fake Trust Wallet site as researchers uncover JavaScript scam — separate claim surfaces of $1.1M iOS exploit Binance co-founder Changpeng “CZ” Zhao has warned crypto users about a phishing site impersonating Trust Wallet, after security researchers uncovered malicious JavaScript designed to trick visitors into connecting their wallets. The alert lands alongside a separate, unverified claim that attackers have stolen roughly $1.1 million from Trust Wallet users via an iOS exploit. What was found - Security researcher Anurag (Malwarehunter on X/Twitter) discovered the fraudulent site on November 5, hosted at trastwallet[.]cam. The site mimics Trust Wallet and presents a “Review your wallet transfers” flow that asks visitors to connect their wallets. - The JavaScript on the page is built to integrate with multiple wallets — Trust Wallet, Phantom and OKX Wallet — and contains two main components: a wallet-scanning endpoint and a JS integration file that handles wallet connections. - Once a user connects, the script can query wallet balances via a backend API and prepare transfers to hard-coded recipient addresses. When Anurag inspected the site, transaction signing was reportedly disabled, which limited the attack’s immediate capability to execute transfers. CZ’s warning - CZ amplified Anurag’s findings and urged caution, highlighting the domain trick: “.cam is not .com. Be careful!” His post stressed the need to verify website addresses before connecting wallets. The $1.1M iOS exploit claim - Separately on November 5, X account Emperor.SOL posted that an unnamed attacker had allegedly extracted seed phrases from devices running iOS 18.5 and drained about $1.1 million from Trust Wallet users. - The post quoted Trust Wallet support urging users to update iOS immediately and included a screenshot showing large transfers (e.g., 500,000 USDT, 100,000 USDT, 190,000 USDT) routed through Binance deposit/hot wallets. The screenshot did not prove the transfers were caused by the claimed iOS exploit. - This remains an allegation reported via social posts; researchers and vendors have previously documented iOS-targeting exploits that can expose wallet data, and vendors typically recommend patching and updating devices. Context — recent and prior incidents - Researchers in March (Google/Lookout/iVerify) found the DarkSword exploit chain that used compromised websites to target vulnerable iPhones and expose wallet information; Apple patched the issue in updates at the time. - Trust Wallet users have reported suspicious losses recently: on November 4 a user reported 3,830 USDT missing without approval, and other users described social-engineering attacks (e.g., malicious impersonators on Discord) that led to drained wallets. - Trust Wallet previously flagged a fake crypto card website (late October) that lured users with generous card limits and cashback and required wallet connection; Trust Wallet staff confirmed the site was fraudulent. - The OneKey founder also warned on November 1 about hard-to-fix hardware vulnerabilities affecting older iPhones (iPhone 4S through iPhone 11 and 2nd-gen SE), recommending users who exposed seed phrases on those devices generate new recovery phrases and move assets. What users should do now - Always verify domain names and use official links from wallet providers’ verified channels. Beware subtle typos and unfamiliar TLDs (e.g., .cam vs .com). - Don’t connect your wallet to unknown sites or sign transactions you don’t fully understand. - Keep mobile OS and apps updated — install iOS updates promptly. - If a recovery phrase may have been exposed, generate a new wallet/seed on a secure device and transfer funds. - Consider hardware wallets for significant holdings and use standard security hygiene (phishing awareness, strong device security, minimal on-device storage of seeds). Takeaway The discovery of a multi-wallet phishing page underscores how attackers combine UI deception and wallet integrations to harvest access. At the same time, claims of an iOS-targeting drain — while not independently verified in public reporting — reiterate the long-standing advice: validate domains, update devices, avoid connecting wallets to untrusted sites, and move funds if a seed may be compromised. Sources: security researcher Anurag (Malwarehunter on X), Binance co-founder Changpeng Zhao, Emperor.SOL (X), community reports and past security research (DarkSword). Read more AI-generated news on: https://app.chaingpt.org/news