SignLensIncidents › Blind signing: Bybit, Radiant, WazirX
Blind signing: what the signers saw, and what they signed
Published
Blind signing is approving a transaction you cannot read: a hash on a hardware wallet, or an interface's description of what it says the bytes do. Clear signing is the opposite: the transaction itself, decoded into words, before you sign. Three well-known thefts of 2024 and 2025 happened on Ethereum and chains like it, which SignLens does not explain yet (Ethereum is next), and they are the case for it.
Bybit, 21 February 2025: about $1.5 billion
Attackers compromised a developer's computer at Safe{Wallet} and changed the JavaScript of Safe's web interface for Bybit's signers only. The signers saw a routine transfer from cold storage to a hot wallet. What they signed was a delegate call to the attacker's contract, which replaced the logic of the multisig itself. Their hardware wallets showed data the signers could not read.
Radiant Capital, 16 October 2024: about $50 million
Malware reached a developer through a message from a fake former contractor. The multisig's interface and its simulations showed legitimate transactions; the hardware wallets were given transfers of the lending pools' ownership, collected through requests to sign again after a supposed failure.
WazirX, 18 July 2024: about $230 million
According to WazirX, the signers saw the expected tokens and a whitelisted destination in their custody provider's interface, and got email confirmations; the payload upgraded the multisig to a contract the attacker controlled. Liminal, the custody provider, disputes WazirX's account.
What clear signing changes, and what it cannot
In each case the screen described one transaction and the signers signed another. Decoding the bytes being signed, rather than trusting a description of them, is the defence, which is what SignLens does: for Solana today, and for Ethereum next. It is not a defence against everything: a computer whose browser is compromised can show anything, SignLens's window included, and nothing a transaction explainer does helps when keys are stolen outright.
On Solana, the Slope wallet's leak of seed phrases in 2022, the DEXX key leak in 2024 and the backdoored @solana/web3.js versions of December 2024 stole keys; Mango Markets (2022) and Loopscale (2025) exploited how prices were set; Wormhole, Cashio and Crema (2022) were bugs in programs. None of them asked a victim to sign anything.
Try it: install SignLens for Chrome or Firefox.