Clear signing and blind signing: what you really confirm

What clear signing and blind signing mean on a hardware wallet, why Ledger compares blind signing to signing a blank check, and what the Bybit theft teaches.

Key points

Clear signing means the device shows in plain words what you approve: the recipient, the amount, and what a contract will do. Blind signing means it shows only a code you cannot read.
Ledger compares blind signing to signing a blank check. On its devices, blind signing is off by default.
The device screen is the only one you can trust. In the Bybit theft of 2025, the signers approved what a manipulated interface on their computers showed them.

Why the device has its own screen

Your computer can be infected, and a website can lie. The hardware wallet’s own screen is the one place that shows what will really be signed. That is only worth something if the screen shows information you can read and check.

Clear signing

With clear signing, the device translates the transaction into readable fields: the address it goes to, the amount, and for a smart contract, what the contract will do and who will receive what. You compare these fields with what you intended.

BitBox, for example, added in its firmware 9.27.1 of August 2026 that the device shows the message type of an Ethereum signature request before you sign.

Sometimes the wallet app cannot interpret a new or complex smart contract. The device then shows a warning and only a raw hash, a long code that tells you nothing about what you approve. That is blind signing.

Ledger calls asking someone to blind sign “like asking them to sign a blank check” and says blind signing has been used by scammers to take billions from customers. On Ledger’s devices, blind signing is off by default and has to be switched on in the settings.

What the Bybit theft teaches

In February 2025, the signers of a cold wallet at the exchange Bybit approved a routine transfer. The interface on their computers had been manipulated and showed them something other than the transaction they signed. The transaction handed the wallet to the attackers, and the FBI put the loss at USD 1.5 billion. Several signers and a cold wallet did not help, because the decision was based on a screen the attackers controlled.

What you can do

Read every transfer on the device screen: the full address, the amount, and the network. Do not rely on the computer or phone.
Leave blind signing off. If a transaction needs it, stop and find out why.
Reject anything you did not start yourself, even if a website says it is needed to claim a reward.
Send a small test amount to a new address first.
For large amounts, check on a second device before you sign, as Bybit’s case shows organizations should.

Next step

The guide Passphrase and multisig shows how several keys spread the risk, and why every signer still has to check.

The figures in this guide come from the archive and change with every data update. As of November 13, 2026.