Fake Trust Wallet card site dangles 8% cashback for a $1 fee, then asks users to connect their wallets

A website using Trust Wallet’s name and logo is advertising a crypto card with up to 8% cashback, no identity checks and a $1 issuance fee, then asking visitors to connect their wallets, security researcher @0xDani warned on X on 28 October 2026. James Bro, who identified himself as a member of Trust Wallet’s security team, said the site is not affiliated with the company.

Three card tiers use luxury perks to make the offer convincing

The website’s presentation appeared designed to make the offer look like a legitimate financial product rather than an obvious phishing attempt. Its three advertised options — Lite, Signature and Metal — offered progressively more attractive rewards under the Trust Wallet name and logo.

The Lite tier reportedly promised cashback of up to 3%, while Signature advertised up to 5%, alongside priority customer support and zero foreign exchange fees. The premium Metal option claimed to offer 8% cashback, unlimited airport lounge access and 24-hour concierge services.

The combination of generous rewards, premium travel benefits and a minimal issuance fee could encourage users to overlook important questions about the issuer, regulatory authorization and the terms governing the advertised services.

The purported licenses in four countries also added an appearance of legitimacy. However, a website’s own licensing claims are not proof that it is authorized to issue payment cards or provide financial services. Those claims require independent verification.

The key concern is the site’s demand for wallet access. A Crypto card website that asks users to connect a self-custody wallet and sign unfamiliar requests creates a potential route for attackers to exploit trust in a recognizable brand.

No independently confirmed evidence in the supplied reports establishes how the operators intended to use the connections, whether the site successfully stole funds, or how many people may have interacted with it. The security team’s confirmation that the site was unaffiliated with Trust Wallet is the central verified warning.

Malicious wallet approvals pose a bigger risk than the connection itself

Connecting a cryptocurrency wallet to a website does not automatically hand over control of its funds. The danger can arise when a user subsequently signs a transaction, grants token-spending permissions to a malicious smart contract, or discloses a recovery phrase.

Some token approvals allow a designated smart contract to transfer specified assets from a wallet. If a user authorizes a malicious spender, the attacker may be able to move eligible tokens without obtaining the wallet’s private keys.

This distinction matters because fraudulent platforms often disguise dangerous requests as routine registration, verification or payment steps. A user expecting to claim a card could approve a transaction without fully understanding its consequences.

Previous incidents cited in crypto security reporting illustrate how costly these mistakes can become. Reports have described losses involving malicious transaction approvals and deceptive exchange websites, while blockchain security researchers have also documented attacks involving token-spending permissions.

Trust Wallet’s own security guidance identifies social engineering, malicious smart-contract approvals and counterfeit wallet applications among the risks users should take seriously.

For anyone evaluating a Crypto card website, the lesson is to examine the transaction request itself rather than relying on the site’s design, brand logos or advertised benefits. A familiar logo does not establish that a service is authentic.

How Trust Wallet users can protect their crypto

Trust Wallet has directed users toward its official application and website, emphasizing the need to avoid suspicious wallet connections and signature requests. Its security resources also advise users to verify website addresses and obtain wallet software through trusted distribution channels.

Users should take several precautions:

• Verify the domain: Access Trust Wallet by entering its official address, trustwallet.com, directly or using a trusted bookmark.

• Avoid suspicious approvals: Do not sign transactions or grant token permissions simply to claim rewards or obtain a payment card.

• Protect recovery phrases: Never disclose a wallet’s recovery phrase to a website, support agent or card issuer.

• Review existing permissions: If you previously approved a suspicious transaction, check your token allowances using a trusted blockchain tool and revoke unauthorized permissions where possible.

• Act quickly after exposure: If your recovery phrase has been compromised, move remaining assets to a newly created, secure wallet. Revoking token approvals alone will not protect a wallet whose recovery phrase has been exposed.

The broader warning extends beyond one imitation service. As crypto payment products become more familiar to consumers, scammers can exploit demand for convenient spending, cashback and premium benefits to make fraudulent offers appear credible.

Ultimately, a Crypto card website promising unusually generous rewards should be treated with caution until its affiliation, issuer and regulatory claims can be independently verified. In this case, Trust Wallet’s security team has explicitly denied the site’s legitimacy, making avoidance the safest course of action.

The reported $1 issuance fee and 8% cashback may attract attention, but neither benefit is worth risking access to a cryptocurrency wallet. Users should prioritize verified services and scrutinize every transaction or signature request before granting permission.