trustsync[.]help

This domain, trustsync[.]help, operates as a crypto wallet drainer designed to deceive users into importing their cryptocurrency wallets. The page title, 'Import a Wallet,' directly targets individuals attempting to access or recover their digital assets, tricking them into entering sensitive recovery phrases or private keys. Once submitted, these credentials are harvested by threat actors, enabling unauthorized access and immediate theft of funds from connected wallets. The infrastructure is specifically engineered to exploit users during wallet migration or recovery processes, a common vector for high-value crypto theft. Analysis of the domain reveals multiple high-confidence indicators of malicious activity. The domain was registered on January 11, 2026, through Dynadot LLC, and resolves to the IP address 192.185.33.172, hosted on AS19871 (Network Solutions, LLC) in the United States. A Let's Encrypt SSL certificate (R13) is present, providing a false sense of security. The domain appears on four security blocklists and is flagged by 23 out of 95 security vendors on VirusTotal, including specialized crypto security platforms. Additionally, it has been proactively blocked by Polkadot, Enkrypt, and other wallet protection systems, confirming its role in targeting cryptocurrency users. Users who visited trustsync[.]help or entered any wallet credentials on the site should assume their funds are at immediate risk. Disconnect all devices from the internet and transfer remaining assets to a new, secure wallet using a clean device. Revoke any connected dApp permissions and monitor all linked accounts for unauthorized transactions. Report the incident to relevant blockchain security teams and consider filing a report with local cybercrime authorities. Do not reuse the compromised recovery phrase or private key under any circumstances, as threat actors may retain access for future exploitation.