Last updated: October 30, 2026
Blind signing means approving a crypto transaction or message without being able to read what it does: your wallet or hardware device shows a hash or raw data instead of the real recipient, amount and action. It's how some of the biggest thefts in crypto happened. In the 2025 Bybit hack, signers approved what their screens showed as a routine transfer, and $1.5 billion left a cold wallet. The fix is clear signing: you see the real details on a trusted screen, check them, and only then sign. Below: how blind signing works, real cases and how to avoid it.
- ~$1.5B lost by Bybit to a blind-signed transaction
- 1 trusted screen should show the details
- 3 things to check: address, amount, action
- Off by default: Ledger's blind-signing setting
Blind signing vs clear signing
| Blind signing | Clear signing | |
|---|---|---|
| What you see | A hash, raw hex or "Data present" | Recipient, amount, token, contract action in plain words |
| Who decides what it means | The website or app, which may be compromised | Your wallet or hardware device, which decodes it itself |
| Typical case | Complex smart-contract calls, multisig transactions, unknown message formats | Simple transfers, well-known contracts, structured messages |
| Risk | High — you're trusting the screen that may be lying | Low if you actually read it |
A hardware wallet protects your key, but if it can only show you a hash, it can't protect your decision. A compromised website or computer can show you one transaction and send another to the device.
Real cases
- Bybit, February 2025 (~$1.5B). Attackers compromised a developer machine at Safe{Wallet}, the multisig service Bybit used, and injected code into its web interface. Bybit's signers saw a normal transfer, but signed a transaction that changed the wallet's logic and handed control to the attackers. The FBI attributed it to North Korea's TraderTraitor, the group blamed for the 2026 Binance hack.
- Radiant Capital, October 2024 (~$50M). Malware on developers' computers showed legitimate transactions in the interface while the hardware wallets were asked to sign malicious ones.
- Everyday drainers. "Sign to log in" or "claim your airdrop" pages ask for permit signatures that hand over tokens — wallet drainer scams and airdrop scams.
How to avoid blind signing
- Read the device screen, not the website. Check the recipient address, amount and action on your hardware wallet. If they don't match what you intended, reject.
- Keep blind signing switched off on your hardware wallet. Turn it on only for one specific transaction you've verified another way, then switch it off again.
- Use a wallet with transaction simulation, which shows what will leave and enter your wallet before you sign. Some wallets, like Rabby, do this built in.
- Be suspicious of any signature on a login or claim page. Logging in should never require a transaction, a permit or an EIP-7702 authorization.
- For multisig wallets, have each signer verify the transaction hash on a separate, clean device, using an independent tool rather than the same web interface.
- Keep signing devices clean. No pirated software, no random extensions — infostealer malware and fake extensions are how attackers get in.
What clear signing looks like today
Wallet makers are moving toward clear signing by default. Hardware wallets decode more contract calls into plain language, and Ledger has pushed an open format (ERC-7730) that lets apps describe their transactions so devices can display them. Structured messages (EIP-712) show labelled fields instead of raw hex, which helps, but a readable message can still be a malicious permit, so read it anyway. Simple transfers are always clear-signed: you see the address and amount.
Frequently asked questions
What is blind signing in crypto?
Approving a transaction or message without seeing its real content. Your wallet shows a hash or raw data, so you can't tell whether you're sending $10 to a friend or giving a contract control of your funds.
Should I enable blind signing on my Ledger?
Keep it off by default. Some DeFi actions require it; if you must, enable it for that one action after verifying the transaction another way, then disable it again.
How did blind signing cause the Bybit hack?
Attackers altered the Safe{Wallet} web interface Bybit used. Signers saw a routine transfer on screen, but their devices signed a transaction that changed the multisig's logic, letting attackers drain about $1.5 billion in ETH.
Does a hardware wallet protect me from blind signing?
Only if it shows you the real details and you check them. A hardware wallet keeps your key safe, but if it displays only a hash, it can't stop you approving a malicious transaction.
Do I need to sign anything to use an instant swap?
No. With an instant exchange you send coins to a deposit address as a normal transfer, which every wallet clear-signs: you see the address and amount.
Plain transfers are the safest thing you can sign. Swap that way on /swap, for example ETH → XMR, without connecting your wallet to anything. No account, no ID, no logs.