Approvals and signatures

Signing a message in your wallet: when “just log in” is dangerous

Updated 3 min read

In short

  • A message signature costs no fee, so it feels safe. But a signature can hand over a token approval or confirm someone else’s transaction.
  • Signing readable text is safe: “Log in to example.com, code 4821”.
  • A long hexadecimal string, typed data with an amount or address, a wallet warning — reasons to reject.

Why sites ask for a signature

There is one honest reason: to prove you own an address without sending a transaction. Many services log you in this way. The text of such a signature is human-readable: the site address, a date, a one-time code.

Scammers exploit the fact that a signature is “free” and does not look like a transfer.

Dangerous signatures

  • Blind signing. You are shown a string like 0x8f3a… with no explanation. It may be a transaction fingerprint: by signing it you confirm a transfer or permission change that the scammer then broadcasts.
  • Typed data (TIP-712 and similar). Inside are fields like spender, amount, deadline. This is an approval of your tokens or a sell order, made without a transaction.
  • A signature “for an AML check” or “to unlock”. Neither an address check nor an unfreeze needs a signature: /check works from the address alone.

How to read the wallet window

  • Find the address of the site requesting the signature. Does it match the one you opened?
  • Look for the words spender, amount, approve, permit, addresses and amounts. Logging in needs none of them.
  • A wallet warning about risk or an “unknown data type” is enough to reject.

If you already signed

  1. Check the address’s approvals in GuardPay /revoke and revoke unfamiliar ones, see unlimited approvals.
  2. Check whether the account permissions changed, see the multisig trap.
  3. If there are signs of either, move the funds to a new address and follow what to do if you were scammed.

Check and revoke approvals

Who you allowed to spend your USDT, read live from the contract. Revoke in your own wallet: one signature per approval, your keys stay with you.

Check approvals

FAQ

Can a message signature be cancelled?

The signature itself cannot be withdrawn. If it granted a token approval, that can be revoked with a transaction in your wallet. If it signed someone else’s transaction, that is already on the network, and only moving the rest to a new address helps.

Is logging in to a site with a signature safe?

Yes, if the window shows readable text with the site address and a code, without amounts or recipient addresses. Such a signature cannot be used to move money.

This guide explains how schemes work and how to protect yourself. It is not legal or financial advice.

Read next