cd ~/blog && cat signing-what-you-see.md
Signing what you see
The screen you trust
When you sign a paper contract, what you read is what you sign. There’s no way for the words to change between your eyes and the pen.
On a screen, though, what you see and what you sign are two different things travelling along two different paths. They almost always match. What if someone slips in between?
Just another Friday
On 21 February 2025, the Bybit exchange did something it did regularly: move funds from one of its cold wallets to one used day to day. It was a multisig wallet, which needed approval from several people, each with their own signing device.
The signers opened the web app they used to manage the wallet. They saw the right address, the right amount and the right website. They approved.
But the code behind that website had been tampered with days earlier, and it was set to activate on exactly that operation. What the screen showed was the routine transfer. What reached the signing devices was something else: an instruction to change the wallet’s own logic and hand control of it to the attackers. That’s how around 1.5 billion dollars vanished, the largest theft in the history of cryptocurrency.
Nobody broke any encryption. They attacked the most human step of all: approving.
Signing blind
The signing devices did receive the real operation. The problem is that they couldn’t show it in a readable way: they displayed a string of technical data that nobody can make sense of at a glance. And since it was a routine operation, the signers trusted what they had already seen on their computers.
This has a name: blind signing. Approving something whose real content you can’t see, because you trust another screen that has summarised it for you.
It’s far more common than it seems, and not only with cryptocurrency. We accept terms we don’t read, confirm payments from an app notification or approve requests because “it’s the usual one”.
The only screen that matters
The underlying lesson is uncomfortable but useful: your computer screen can’t be trusted for what matters. It can be tampered with by malware, by a browser extension or, as here, by the very website you trust.
That’s why signing devices exist, the ones we covered when looking at why the word “wallet” causes so much confusion. Their value isn’t only in keeping the keys: it’s in having a screen of their own that the attacker doesn’t control. If that screen shows you what you’re about to sign and you look at it, the trick falls apart.
Several signers weren’t enough, because they were all looking at the same tampered screen. Four eyes only help if each pair is looking at something different.
A habit for whoever signs
Before approving any important operation, read what the device says, not the computer. Check the destination address, the amount and the type of operation.
Do it above all on routine operations, which is when we let our guard down. And if the device can’t show you what you’re signing in a way you understand, don’t sign until you can check it another way.
A rule for whoever builds
For anyone designing approval systems, the rule has a classic name: what you see is what you sign. Every approval should be shown, on the trusted screen, in language a person can understand.
If a system forces its users to sign blind, the fault isn’t with whoever signs: it’s with the design.
Look before you approve
The most expensive attacks don’t always break the technology. Sometimes they simply wait for someone to approve without looking.
Signing is an act of trust. Make sure you’re trusting the right screen.