The End of Blind Signing on Ethereum
A new open standard called Clear Signing aims to fix the structural flaw that let hackers drain Bybit, WazirX, and Radiant Capital.
By The crypto-money Desk
In February 2025, attackers drained approximately $1.5 billion from Bybit—the largest crypto theft on record at the time. They did not crack a private key. They did not brute-force a password. They waited for a human being to tap approve on a hardware wallet screen, not knowing what they were actually signing. [1][2]
The mechanics were precise. Users saw a legitimate transaction on-screen but were unknowingly approving a manipulated transaction at the protocol level. Once signed, the transaction replaced the smart contract wallet's logic with DPRK-deployed code, allowing the attackers to control and empty the funds. [2]
The second layer of the attack relied on a simpler, older problem. Because Ledger requires blind signing when interacting with smart contracts, victims had no way to verify the true transaction details before approving them. The combination of these two attack vectors created a near-perfect deception. [2]
The Bybit breach was not an anomaly. It was the logical endpoint of a design compromise that the crypto industry made years ago and never fully reckoned with.
Blind signing began as a practical shortcut. The first hardware wallets were built around basic transfers—straightforward amounts sent to known addresses. As Ethereum's ecosystem grew more complex, with DeFi protocols and NFT marketplaces demanding intricate smart contract interactions, wallets could no longer easily decode every transaction into readable text. The industry's answer was to let users sign these transactions blindly—without knowing what was actually being approved. [1]
That shortcut calcified into a structural vulnerability. Blind signing played a key role in the hacks of Bybit (~$1.5B), WazirX (~$230M), and Radiant Capital (~$50M). These kinds of heists will absolutely continue to creep up so long as blind signing remains open as a pressure point for advanced persistent threats like Lazarus Group. [1]
Fireblocks, whose founding traces directly to Lazarus and other high-profile attackers—Lazarus and other high profile attackers are the reason Fireblocks was founded—described the problem in terms that cut through any ambiguity: using separate smart account wallets alongside hardware signing solutions leaves crucial blind signing gaps, with users approving transactions they can't fully verify. Wallet web UI reliance is dangerous—if JavaScript is manipulated, the entire security model collapses. [2]
The diagnosis has been available for years. What the industry lacked was a coordinated, open-standard response that any wallet or protocol could adopt without rebuilding from scratch.
That response has now arrived. [1]
Central to this effort is ERC-7730, a shared format that lets protocols describe what their transactions actually do in plain language. A team can write a JSON descriptor that assigns readable fields to raw contract calls, then publish that descriptor to an open registry stewarded by the Ethereum Foundation. Wallets fetch from this registry as needed, allowing users to know exactly what's being asked when signing transactions. [1]
More than 40 protocols have already published descriptors to the ERC-7730 registry, including Aave, Lido, Uniswap, and Safe. Ledger is live with Clear Signing support. [1]
The architecture here matters as much as the intent. A permissioned, centrally curated list would recreate the single points of failure that made the Bybit attack possible in the first place. An open registry shifts trust to the network and to the wallets themselves.
Without a policy engine configured to enforce address and amount logic, costly mistakes are inevitable. [2]
ERC-7730 addresses the first of those requirements directly. It cannot, by itself, prevent a compromised developer machine from injecting malicious JavaScript into a wallet interface. That layer still demands zero-trust security processes, including deep code reviews and sensitive code approvals, execution of highly-sensitive code via a trusted environment, and rigorous internal and external audits. A single developer's clear and direct access to production is dangerous—and must be mitigated. [2]
The deeper issue is that user education has never been the right answer. It places the burden of a structural flaw on the person least equipped to detect it. As the Bankless analysis put it, user education simply can't overcome blind signing because the threat vector it opens up is a structural problem. Clear Signing is the structural fix. [1]
For enterprises and retail users alike, the shift will be gradual. Protocol coverage in the ERC-7730 registry needs to widen before Clear Signing becomes a meaningful default across the ecosystem. Wallet vendors beyond Ledger need to ship support. And users need to learn to notice when a signing request is human-readable versus when it is not—and treat the latter with genuine suspicion. [1]
The Bybit attack was a $1.5 billion lesson in what happens when infrastructure design is treated as someone else's problem. Clear Signing will not end every crypto theft. But it closes the specific gap that Lazarus and its peers have exploited most efficiently. The open registry is live. The standard is written. Now the work is adoption—protocol by protocol, wallet by wallet, until blind signing is no longer the path of least resistance for anyone, attacker or user. [1][2]
User education simply can't overcome blind signing because the threat vector it opens up is a structural problem.William M. Peaster