In the blockchain security landscape, hardware wallets remain one of the most robust defenses against unauthorized access to digital assets. However, as recent high-profile breaches have shown, their security hinges on more than the devices themselves—it depends on how well users verify the transactions they’re signing on those devices.
In a recent video, Cyfrin CEO and security researcher Patrick Collins explained what every hardware wallet user should know: the essential details that must appear on-screen when signing transactions or messages.
Understanding these cues could mean the difference between protecting your assets and falling victim to a hack.
The recent $1.4 billion Bybit hack is a stark reminder of what’s at stake. Even with a multi-signature wallet setup, requiring three separate approvals, the exchange was compromised by a sophisticated attack that deceived the signers. On screen, the interface showed clean, legitimate-looking transaction details. But the data actually sent to hardware wallets contained hidden, malicious instructions.
This exploit drives home a cardinal rule in blockchain security: never sign a transaction based solely on what you see on screen. Always verify the actual operations your hardware wallet is being asked to approve.
Note: While messages and transactions may look similar in the wallet interface, they serve different purposes. Messages are off-chain signatures used for things like Safe approvals, while transactions trigger actual on-chain actions. Both require careful verification but for different reasons.
Most modern blockchain signatures follow the EIP-712 standard, which organizes message data into a structured, human-readable format. When you sign a message, the process involves three components:
These three components, domain, types, and message, are hashed together to produce a final digest. That digest is what your private key actually signs. In the case of Safe multi-sig wallets, this digest is called the Safe transaction hash, or SafeTxHash.
When signing a message, hardware wallets should provide sufficient information to verify what's being signed. Any of the following are acceptable, though some make verification easier than others:
For example, Ledger Flex shows both the domain and message hashes as well as the full data structure in a readable format.
For users who need to verify signature data, especially in multi-signature setups like Safe, several tools can help:
When you send a transaction, you're not just confirming identity—you’re authorizing actual instructions to be executed on the blockchain. That makes calldata crucial to inspect and understand.
Transaction signing introduces a unique set of verification challenges compared to simple message signing. While both involve cryptographic signatures, they serve different purposes.
In some systems, such as Safe multi-sigs, signing a message is part of a multi-step process that ultimately results in an on-chain transaction. In others, such as logging into an app or signing an off-chain vote, the message signature is never followed by an on-chain transaction.
At a minimum, hardware wallets must show:
DelegateCall.Ideally, wallets should also decode the calldata into a human-readable format. However, since decoding isn’t always perfect, some security researchers may prefer access to both the decoded and raw versions.
This guidance takes on added urgency in light of the recent Bybit exchange hack. Despite using a multi-signature setup, Bybit's signers approved a malicious transaction that contained multiple red flags that might have been caught with proper hardware wallet verification:
1, indicating a DelegateCall, a risky and sometimes abused function.Had the signers reviewed the full calldata on their hardware wallets and known what to watch for, they may have spotted the anomalies before the damage was done.
Based on this information, several best practices emerge for hardware wallet users, especially those managing assets:
When signing messages, your hardware wallet must provide enough detail to verify exactly what you're approving. At a minimum, it should display the:
Ideally, it should show the final SafeTxHash or the domain hash and message hash component, giving you an extra layer of assurance.
When signing transactions, the requirements go deeper. Your hardware wallet should display:
The most secure wallets decode calldata into clear, human-readable actions. But access to the raw calldata remains essential for advanced users who want full control and transparency.
As sophisticated attacks continue to target major protocols, these verification capabilities are essential security requirements. Understanding what to look for and how to verify the information your wallet displays could be the difference between security and compromise.
With this foundation in place, you may want to learn how to verify calldata with Cyfrin’s safe-tx-hashes.
For those looking to enhance their blockchain security skills, Cyfrin's Security & Auditing course on Updraft provides comprehensive training on identifying and preventing these types of attacks.
Stay safe out there, and always verify your transactions.
