Signatures and addresses
Lesson 14 of 16 in the course “Cybersecurity from Scratch”. Free, with animations and a quiz.
Address poisoning
A wallet address is long, so we only check the start and the end. Scammers exploit that: they create an address whose first and last characters match, and send you an empty transfer from it. It lands in your history, and next time you copy it instead of the real one. In May 2024 one transfer sent 1,155 WBTC, about $68 million, this way. That owner was lucky and got the money back later, but usually it never comes back.
A signature isn’t “just a signature”
A wallet asks you to confirm more than transfers. An approval gives a contract the right to keep taking your token later, sometimes with no limit. A permit signature does the same but looks like a harmless “sign this message” and doesn’t even cost a fee. And since Ethereum’s May 2025 upgrade there’s a signature that hands your account to outside code. Scammers already plug in “sweepers” that grab everything that arrives at the address. Drainer sites exist to trick you into exactly these signatures.
Even pros sign blind
On 21 February 2025 the exchange Bybit lost $1.5 billion. Attackers infected the computer of a developer at Safe{Wallet}, the service Bybit used to sign transfers. Staff saw a normal transfer on the site and signed it. In reality the signature handed over control of the wallet. The takeaway for us: if your wallet shows unreadable code instead of a clear “send X to Y”, that’s a blind signature. You don’t sign it.
How not to get caught
Copy addresses from your contacts or the recipient’s screen, not from your transaction history. Before a large amount, send a small test transfer and ask for confirmation. Once a month, open revoke.cash or a similar tool and revoke unknown approvals. For new projects, airdrops and meme coins, keep a separate wallet with a small amount. And don’t connect your main one anywhere except trusted places.
Check yourself
- Dan’s history shows an address that looks like his friend’s: same start and end. Where should he get the address?
Correct answer: From saved contacts or the friend, with a test transfer first. A lookalike in history is a poisoning trap. The address source must be your own. - An airdrop site asks you to “just sign a message”, no fee. What’s the danger?
Correct answer: The signature can grant the right to take your tokens. Permit and account-handover signatures need no fee and take everything. - At signing, the wallet shows unreadable data instead of “send X”. What should you do?
Correct answer: Reject it: it’s a blind signature. If you don’t understand what you sign, don’t sign. That’s how even Bybit lost $1.5B.