Past Attacks
- Private key theft
- Phishing
- Malware
- Direct intrusion
Why Now
The Risk Moved From the Key to the Path
Why pre-sign security matters now — the threat landscape, the irreversible moment, and the attacks SignTrail is built for.
Why Now
Attackers No Longer Just Steal Keys
Even legitimate signers and trusted systems can approve dangerous transactions through manipulated paths.
New Attacks
- Legitimate approver
- Manipulated signing request
- Fake UI
- Compromised developer environment
- Valid signature
- Asset theft
Bybit $1.5B Incident
A large asset movement that appeared to pass normal approval procedures still resulted in catastrophic loss.
Target Scope Is Expanding
Exchanges, DeFi services, bridges, RPC node operators, analytics firms, VASPs.
The Weak Point Is the Path
The key may be secure, but the request reaching the signer may not be.
Source: FBI / IC3 Public Service Announcement on the Bybit incident (TraderTraitor).
Core Perspective
Signing Is the Final Moment
Once a valid signature is generated, prevention ends and incident response begins.
- Intervention Possible
- Irreversible
- Request
- Approval
- Pre-Sign Check
- Signingpoint of no return
- Broadcast
- Settlement
SignTrail is the final control point before assets move.
Threat Brief
Built for DPRK-Style Web3 Attacks
DPRK-linked attackers increasingly target people, developers, infrastructure, and signing workflows — not just contracts.
- TV-01
Fake Hiring
Malicious repositories, fake interviews, developer environment compromise.
- TV-02
Fake Investor/Partner
Social engineering through investment, partnership, or due diligence conversations.
- TV-03
Developer Compromise
Account takeover, CI/CD abuse, package or deployment path manipulation.
- TV-04
Signer Manipulation
Legitimate signers approving manipulated requests.
- TV-05
Operational Workflow Abuse
Withdrawal requests, multisig approvals, admin actions, and treasury movements disguised as normal operations.
SignTrail turns threat intelligence into pre-sign control.