- Project Crypto Wallet Drainer — trustspendcards.net
- Company Merabytes
- Sector Fintech / DeFi
- Date : 24 June, 2026
- Duration Active campaign
Today, while most people had a day off, we were reviewing a suspicious Instagram ad forwarded by one of our users.
The user manages their company’s crypto treasury and was looking to convert crypto to fiat. 14 minutes after they flagged it we had the attacker’s wallets, API keys, backend secret and the full drain logic. Here’s what was inside.
A campaign with real budget and Meta Ads
What makes this scam stand out is that it’s actively buying Instagram ads and is still live. The lure: a “VISA USDT Debit Card” for DeFi users. This is an operation with stolen branding from a trusted name in crypto (Trust Wallet), functional technical infrastructure, and the ability to drain 7 blockchains simultaneously.
Why it works
The ad impersonates something DeFi users have been waiting for: a bridge between crypto and the traditional payments system. A card to spend USDT at any merchant is exactly what millions of crypto users would want.
The wallet connection flow — that “connect your wallet to verify your identity” step — is familiar enough to any DeFi user that the alarm never goes off.
The drainer
trustspendcards[.]net, when you click the button to request your card, loads a WalletConnect v2 modal on onload, disguised as a funds verification transaction. The public Vite/React JavaScript (index-BJT51uc1.js) contains the full drain logic in plaintext. No obfuscation.
The page does the following the moment you try to get your crypto VISA:
- Calls the NowNodes API to enumerate your USDT balance across 7 chains: ETH, BSC, POL, AVAX, ARB, BASE, TRON
- Requests
eth_sendTransactionto move everything to the attacker’s EVM wallet - Requests
eth_signTypedDatawith an EIP-712permitfor gasless approvals - On TRON: signs a TRC20 transfer using
tronweband POSTs it to/api/tron-drain - On EVM: registers the approval at
/api/register-approved
Both endpoints authenticate with the HTTP header x-drainer-secret. The victim sees a “card verification” modal. Once they accept, their wallets are empty.
What the attacker left in the frontend
const DRAINER_SECRET = "fOdhGD475JKOEF23rfrje&Fh3u4"; // backend auth — anyone can call the drain endpoints
const EVM_SPENDER = "0xD4d6A26Dc84516FF9e1AC8837Dd347Ebe5bCb0c7"; // ETH/BSC/POL/AVAX/ARB/BASE
const TRON_SPENDER = "TSxfbXySDAtoEyDDAHZxYA6X6dY2nB4P29"; // TRON
const NOWNODES_KEY = "fc94c112-d3c2-4202-8f08-e236870e1e4b"; // live balance recon
The attacker used frontend configuration tooling to expose credentials that should have stayed in the backend. Not great opsec for an otherwise professional-grade operation.
Network contacts on page load
trustspendcards[.]net— payload deliveryexplorer-api.walletconnect.com— wallet listing and icons, abused to project legitimacyconnect.facebook.net— Pixel1695678144955877— victim conversion tracking, live campaign
IOCs
trustspendcards.net0xD4d6A26Dc84516FF9e1AC8837Dd347Ebe5bCb0c7— EVM drain walletTSxfbXySDAtoEyDDAHZxYA6X6dY2nB4P29— TRON drain wallet/api/tron-drain,/api/register-approved— drain endpoints- WalletConnect project
5816c5bba147eba277e1575494697210— report for revocation - NowNodes key
fc94c112-d3c2-4202-8f08-e236870e1e4b— report to NowNodes - FB Pixel
1695678144955877— report campaign to Meta (utm_id: 52525097425042)
No legitimate DeFi protocol asks you to sign a transaction to activate a card. If your wallet shows eth_sendTransaction and you didn’t initiate a swap, close the tab.
The campaign is still live.
#threatintelligence #dfir #defi #cryptodrainer #walletconnect #web3security
Working with digital assets or running a team with DeFi exposure? merabytes.com
Frequently asked questions
An Adversary-Aware SOC goes beyond traditional security monitoring by understanding attacker tactics, techniques, and procedures (TTPs). We proactively hunt for threats using MITRE ATT&CK framework, behavioral analysis, and threat intelligence to detect attacks that bypass conventional security controls.
Traditional security tools focus on known signatures and indicators. Our behavioral detection analyzes anomalies in user activity, email patterns, network traffic, and system behavior to identify sophisticated attacks that use legitimate tools or bypass authentication controls. This caught the attacks in these case studies before significant damage occurred.
Our SOC operates 24/7 with real-time monitoring and automated response capabilities. Critical alerts trigger immediate investigation and containment actions within minutes. We provide continuous threat hunting, forensic analysis, and coordinated incident response to minimize impact and prevent lateral movement.
We combine global threat intelligence feeds with our own research from real incidents. Every attack we analyze contributes to our detection rules and IOC database, which is immediately shared across all protected environments. This means if we see a new attack pattern targeting one client, all clients are automatically protected within hours.
Absolutely. Our SOC integrates with your existing EDR, XDR, SIEM, firewalls, email security, and identity protection tools. We enhance their effectiveness by correlating events across all sources, applying adversary-aware detection logic, and providing expert human analysis that automated tools alone cannot achieve.