SignTrail
Request Threat Brief

Why Now

The Risk Moved From the Key to the Path

Why pre-sign security matters now — the threat landscape, the irreversible moment, and the attacks SignTrail is built for.

Why Now

Attackers No Longer Just Steal Keys

Even legitimate signers and trusted systems can approve dangerous transactions through manipulated paths.

Past Attacks

  • Private key theft
  • Phishing
  • Malware
  • Direct intrusion

New Attacks

  • Legitimate approver
  • Manipulated signing request
  • Fake UI
  • Compromised developer environment
  • Valid signature
  • Asset theft

  • Bybit $1.5B Incident

    A large asset movement that appeared to pass normal approval procedures still resulted in catastrophic loss.

  • Target Scope Is Expanding

    Exchanges, DeFi services, bridges, RPC node operators, analytics firms, VASPs.

  • The Weak Point Is the Path

    The key may be secure, but the request reaching the signer may not be.

Source: FBI / IC3 Public Service Announcement on the Bybit incident (TraderTraitor).

Core Perspective

Signing Is the Final Moment

Once a valid signature is generated, prevention ends and incident response begins.

  • Intervention Possible
  • Irreversible
  1. Request
  2. Approval
  3. Pre-Sign Check
  4. Signingpoint of no return
  5. Broadcast
  6. Settlement

SignTrail is the final control point before assets move.

Why SignTrail

A Different Question, Right Before Signing

Existing tools each guard one angle. SignTrail adds the missing one — was this signing request created on a trusted execution path? — and enforces it before the signer runs.

  • EDR / eBPF

    Is process or system behavior abnormal?

  • Custody policy

    Does wallet policy allow this withdrawal?

  • KYT / AML

    Is the address or transaction risky?

SignTrail

Was this signing request actually created on a trusted runtime path?

  • Pre-sign, fail-closed

    Verifies before the signer runs and stops unverified requests — not after the transaction is broadcast.

  • Runtime path as a signing precondition

    Binds each request to the runtime evidence it came from. No verified path, no signature.

  • In front of your signers

    Sits ahead of HSM / MPC / Fireblocks / Safe. No replacement, no migration.

Threat Brief

Built for DPRK-Style Web3 Attacks

DPRK-linked attackers increasingly target people, developers, infrastructure, and signing workflows — not just contracts.

  • TV-01

    Fake Hiring

    Malicious repositories, fake interviews, developer environment compromise.

  • TV-02

    Fake Investor/Partner

    Social engineering through investment, partnership, or due diligence conversations.

  • TV-03

    Developer Compromise

    Account takeover, CI/CD abuse, package or deployment path manipulation.

  • TV-04

    Signer Manipulation

    Legitimate signers approving manipulated requests.

  • TV-05

    Operational Workflow Abuse

    Withdrawal requests, multisig approvals, admin actions, and treasury movements disguised as normal operations.

SignTrail turns threat intelligence into pre-sign control.