Bybit and Radiant Capital Hacks Highlight Blind-Signing Risks in Hardware Wallets
This analytical piece examines how hardware wallets, despite safely isolating private keys, failed to prevent two major crypto thefts because users could not verify what they were actually signing. In the February 2025 Bybit hack, Lazarus Group compromised a developer's machine at Safe{Wallet} and injected malicious code into the signing interface, causing signers to approve a change to the wallet's logic that handed attackers control and led to the theft of roughly $1.5 billion in ETH. A similar "blind signing" attack hit Radiant Capital in October 2024, where malware on developers' devices spoofed the Safe interface while hardware wallets signed a malicious transfer of contract ownership, draining around $50 million. The article argues that offline key storage alone is insufficient and that transparency (open-source firmware/hardware) plus on-device "clear signing" of transaction details are needed to prevent such attacks.
Detalhes técnicos
The root issue is blind signing: hardware wallets display raw, unreadable contract calldata rather than decoded transaction intent, so if the connected computer's interface is compromised, signers have no trustworthy way to verify what they're approving. The article highlights ERC-7730, a standard proposed by Ledger and stewarded by the Ethereum Foundation, allowing contracts to specify human-readable transaction descriptions for compatible wallets. It also profiles Ambire Ice, a new open-source hardware wallet (unveiled October 30, 2026) built for Ambire and Safe smart accounts, which reconstructs Safe transactions on-device, warns of owner/threshold/module changes, and blocks DELEGATECALLs to unknown contracts unless allowlisted — directly targeting the technique used in the Bybit attack. Ice combines secure elements from NXP and Infineon, a physical switch to disable USB data/Bluetooth for offline QR-based signing, and firmware forked from Trezor's open-source codebase.
Remediação
The article recommends combining secure key generation/storage, transparent and auditable firmware (ideally with reproducible builds), on-device transaction decoding ("clear signing") rather than blind signing, and supply-chain integrity controls for hardware manufacturing, rather than relying on cold storage alone.
Linha do tempo
-
Bybit and Radiant Capital Hacks Highlight Blind-Signing Risks in Hardware Wallets
ler a análise desta fonte ocultar
This analytical piece examines how hardware wallets, despite safely isolating private keys, failed to prevent two major crypto thefts because users could not verify what they were actually signing. In the February 2025 Bybit hack, Lazarus Group compromised a developer's machine at Safe{Wallet} and injected malicious code into the signing interface, causing signers to approve a change to the wallet's logic that handed attackers control and led to the theft of roughly $1.5 billion in ETH. A similar "blind signing" attack hit Radiant Capital in October 2024, where malware on developers' devices spoofed the Safe interface while hardware wallets signed a malicious transfer of contract ownership, draining around $50 million. The article argues that offline key storage alone is insufficient and that transparency (open-source firmware/hardware) plus on-device "clear signing" of transaction details are needed to prevent such attacks.
Technical Details
The root issue is blind signing: hardware wallets display raw, unreadable contract calldata rather than decoded transaction intent, so if the connected computer's interface is compromised, signers have no trustworthy way to verify what they're approving. The article highlights ERC-7730, a standard proposed by Ledger and stewarded by the Ethereum Foundation, allowing contracts to specify human-readable transaction descriptions for compatible wallets. It also profiles Ambire Ice, a new open-source hardware wallet (unveiled October 30, 2026) built for Ambire and Safe smart accounts, which reconstructs Safe transactions on-device, warns of owner/threshold/module changes, and blocks DELEGATECALLs to unknown contracts unless allowlisted — directly targeting the technique used in the Bybit attack. Ice combines secure elements from NXP and Infineon, a physical switch to disable USB data/Bluetooth for offline QR-based signing, and firmware forked from Trezor's open-source codebase.
Remediation
The article recommends combining secure key generation/storage, transparent and auditable firmware (ideally with reproducible builds), on-device transaction decoding ("clear signing") rather than blind signing, and supply-chain integrity controls for hardware manufacturing, rather than relying on cold storage alone.