VERSE PRESS

Crypto News, Global First.

Ethereum Foundation Backs Clear Signing Standard, Targeting Blind Approval Exploits Behind Billion-Dollar Hacks

The Ethereum Foundation formally launched support for Clear Signing on May 12, 2026, a security standard that replaces unreadable transaction data with plain-language descriptions users can verify before approving. The move places a neutral governing body behind a framework previously led by hardware wallet maker Ledger, and arrives as crypto scams and fraud globally reached $17 billion in 2025.

|

The announcement, authored by Hester Bruikman of the Ethereum Foundation, comes under the organization's Trillion Dollar Security (1TS) initiative, which launched in 2025, making Clear Signing one of its first major outputs. The core technical framework is built on ERC-7730, a JSON descriptor format that instructs wallets to display transaction details in human-readable terms. A companion standard, ERC-8176, allows security auditors to cryptographically vouch for the accuracy of those descriptions, adding a verification layer on top of the plain-language display.

The problem Clear Signing targets is known as blind signing: approving a blockchain transaction without being able to read what it actually does. Most wallets today show raw hexadecimal calldata and function selectors, strings of characters that are meaningless to ordinary users and difficult even for experienced developers to parse under pressure. As Bruikman put it in the announcement: "Approving a transaction is meant to be the last line of defense when exercising control over what happens to your assets on the blockchain. When it is done blindly, that defense does not hold."

The practical difference the standard makes is significant. A Uniswap V3 token swap, instead of displaying a wall of hex code, would read: "Send 1,000 USDC, receive minimum 0.42 WETH." The WYSIWYS principle, short for "What You See Is What You Sign," underpins the entire framework. The secure screen on a signing device must reflect exactly what is being cryptographically approved, with no gap that a compromised browser or application interface could exploit.

That gap has already proven catastrophic. In February 2025, attackers injected malicious JavaScript into the Safe{Wallet} interface and caused signers at the Bybit exchange to approve a delegatecall transaction, a low-level command that, in this case, granted the attacker full control over the exchange's multisig contract, while their screens showed what appeared to be a routine transfer. The loss totalled $1.5 billion. Seven months earlier, WazirX, one of India's largest exchanges, lost approximately $235 million after attackers altered a transaction payload between the web interface and the hardware signing device. In both cases, the signing device displayed one thing while approving another. Post-incident analysis by security researchers at Blockaid and Halborn concluded that both breaches were enabled by the blind signing vulnerability Clear Signing is built to close.

Trezor CTO Tomáš Sušánka, commenting on the initiative broadly, said: "This standard changes that, and every wallet provider should embrace it."

The Ethereum Foundation is housing a public registry at clearsigning.org where developers can submit transaction descriptors for any smart contract. The registry is publicly mirrorable and open for independent review. Wallets select which registry instances they trust and then pull the corresponding descriptors to display to users. Governance of ERC-7730 transferred from Ledger, which originally created and open-sourced the specification in 2024 and also led the formation of the Clear Signing Alliance that year, to the Ethereum Foundation in 2026, marking a shift from vendor-led to ecosystem-neutral stewardship. ERC-7730 V2, released in April 2026, added cross-chain compatibility, software wallet support, and confidential-token primitives, extending the standard beyond hardware devices to apps like MetaMask. Named partners in the initiative include Ledger, Trezor, MetaMask, WalletConnect, Fireblocks, ZKnox, Sourcify, Cyfrin, Zama, Keycard, and Argot.

The regional stakes are particularly high outside the United States. India ranked first in the 2026 Global Crypto Adoption Index across 151 countries, with roughly 16 percent wallet penetration among internet users. The WazirX breach remains the most damaging crypto security incident in the country's history, and according to the Blockaid and Halborn post-incident analysis, it was enabled by precisely the blind signing vulnerability the new standard addresses. Security analysts also note that Clear Signing may serve as a compliance reference point under evolving oversight by India's Securities and Exchange Board (SEBI) and the Financial Intelligence Unit (FIU), a dimension that adds regulatory weight to the initiative for Indian institutional participants.

In Africa, Nigeria ranked second globally in adoption, while Kenya, Ethiopia, and Ghana all entered the global top 20 for the first time. Kenya, which ranked fifth globally in stablecoin transaction volumes in 2025, processed over $3.3 billion in stablecoin transactions that year. Yet the continent also recorded the fastest rise in crypto fraud, with fraud rates up 112 percent year over year. Analysts note that most users across Nigeria and Kenya rely on mobile software wallets such as Trust Wallet and MetaMask Mobile rather than hardware devices, which makes the ERC-7730 V2 expansion to software wallets directly relevant to those populations.

The standard is free to implement and permissionless. Any wallet, dApp, or developer can adopt it and submit descriptors to the registry. The Ethereum Foundation is funding Rust and TypeScript libraries to lower the development cost of integration. The remaining question is adoption speed. Clear Signing requires protocol teams to submit descriptors for their contracts, not just wallet providers to flip a switch. Analysts and security researchers caution that smaller and regional protocols, which are common in South Asia and across Africa, may lag in submitting those descriptors, leaving local users exposed during the transition even after major wallets go live with the feature. Developer tooling, including a Python validation package for the registry, is already available at the project's GitHub repository.