A domain registered for under $20. Two characters swapped. One irreversible transfer.
The phishing domain trastwallet.cam โ note the a where the u should be, note the .cam where .com used to live โ is not a hack. Nobody broke elliptic curve cryptography. Nobody found a reentrancy bug in a smart contract. This is typosquatting, the oldest trick in the book, and it worked because the attack surface was never the code. It was the human finger.
I've spent the last six months building a model that separates human from AI-agent activity on DEXs. The signal that keeps showing up: the most profitable exploits in crypto are not technical. They are behavioral, and they cost almost nothing to deploy. That's the part the security-industrial complex doesn't want to say out loud, because behavioral exploits don't get patched.
The Setup
Trust Wallet is a non-custodial, multi-chain wallet acquired by Binance in 2018. Mobile-first, high retail penetration, and โ this is the relevant detail โ heavily reliant on users typing URLs manually or clicking through search results on small screens. That combination is fertilizer for typosquatting.
The trastwallet.cam domain does two things simultaneously. First, the typo trast exploits visual proximity on mobile keyboards and OCR-based link previews โ at a glance, it reads as trust. Second, the .cam gTLD is cheap, loosely policed, and frequently abused. Together they form a double blind spot: users who check the spelling miss the TLD, and users who check the TLD miss the spelling. This is not a random registration. Follow the exit liquidity and you find a phishing crew that has done this before.
Here's what the original alert didn't tell you, and it matters more than the domain itself: the economics of this attack are absurdly asymmetric. Domain registration runs under $20. Front-end cloning is a copy-paste job. Hosting is negligible. The attacker's cost is essentially zero. The victim's cost is 100% of whatever sits in that wallet, with no recovery, no chargeback, no customer service line. In any other financial system, that asymmetry would be regulated into oblivion. In self-custody, it's a feature.
The Evidence Chain Nobody Runs
When I audited Aave v2 for a DAO in 2020, I learned to distinguish between code-layer failures and trust-layer failures. Code-layer failures get GitHub issues, patches, post-mortems. Trust-layer failures get a press release and nothing else. This event is pure trust-layer, which means the forensic chain is short and brutal:
Domain registered โ cloned front-end deployed โ traffic routed (search ads, Telegram, X replies) โ user enters seed phrase โ assets swept โ domain rotated.
The alert disclosed exactly one node of that chain: the domain. It did not disclose the IOC set, the registrar, the registration timestamp, or whether Trust Wallet filed a takedown. That omission is the real finding. A security warning without IOCs is not a warning. It's a headline.
And here's the hidden layer: phishing domains are registered in batches. The .cam registration is almost certainly one of a cluster โ .xyz, .cc, trustwallet.cam, trastwallet.com variants all live in the same operations room. Exposing one domain is like finding one roach. The colony is already downstream.
The Contrarian Read
The consensus take is that this is a Trust Wallet problem. It isn't. Trust Wallet is the victim of trademark abuse, not the perpetrator of a security failure. The non-custodial model means the wallet developer cannot freeze assets, cannot reverse transfers, and cannot recover seed phrases โ by design. For users, this is the entire promise of self-custody. It's also the entire reason phishing remains the highest-ROI crime in crypto.
Chain doesn't forgive. Chain doesn't refund. Leverage kills, but so does a slip of the thumb.
The secondary risk is the one nobody prices: misread virality. Watch how this headline mutates. "Trust Wallet users targeted by phishing domain" becomes "Trust Wallet compromised" within two reposts. That misread triggers withdrawal cascades and wallet migrations that have nothing to do with the actual event. I've watched this exact pattern in liquidation data during the Terra collapse โ the fear-driven exit does more damage than the event itself.
There's also a structural blind spot in how the industry defends. Everyone watches contracts. Almost nobody watches the last mile between the user and the URL bar. The fact that a $20 domain can extract more value than a $10M audit budget prevents should tell you where the real risk lives.
The Forward Signal
The tell to watch is not the domain. It's Trust Wallet's response clock. If the official channels don't publish a takedown confirmation or a blacklist update within 72 hours, treat that as a signal about safety-ops maturity, not about the phishing domain. Second tell: watch whether this domain gets folded into Google Safe Browsing and wallet-built-in blacklists โ that's the only defense mechanism that scales, because users will never reliably check character-by-character.
Whales are circling a different question entirely: which wallet brands enter the "high-typosquat-value" tier next. Brand recognition is now a security liability. That's a strange thing to celebrate. But the addresses are public, and the cluster is watching.
The next warning you see won't include the phishing URL. Ask yourself why. Then save the official domain as a bookmark and never type it again.