Your wallet pops up a signature request, and the screen is full of characters and numbers you can't understand. I know how that feels—like signing a document with your eyes closed. If you don't understand a signature request, don't click "Confirm." This is your last line of defense for protecting your assets.
The world's largest cryptocurrency exchange by trading volume,leading in security and liquidity.
New user benefit: Enjoy 20% off trading fees upon registration!
Before worrying about whether it's an "authorization," the most important thing is to figure out what this "signature" actually is.
Step 1: Check Whether the Signature Is "Off-chain" or "On-chain"
[What to do]: Identify the signature type, because on-chain and off-chain signatures carry different risks.
[How to do it]: A signature request usually shows a gas fee.
Case A: A gas fee is shown → This is an on-chain signature. The operation will be recorded on the blockchain and requires gas, such as token swaps, transfers, or approvals. This usually means assets will be moved or permissions will be granted.
Case B: No gas fee is shown → This is an off-chain signature. It is not recorded on-chain and does not consume gas, such as logging into a website or verifying identity. But off-chain signatures can still be risky—malicious DApps can trick you into signing messages like Permit or Permit2. These don't move assets immediately, but they can grant the other party permission to use your tokens in the future.
[Done when]: You can tell how much gas this signature request requires. If the gas fee shows 0, it is an off-chain signature.
Step 2: Check the "Authorization Details" in the Signature Request
If it is an on-chain signature, especially an "Approve" request, pay close attention to these three details.
Check 1: Is the authorization limit "unlimited"?
[What to do]: See whether the authorization limit is an extremely large number, such as 115792089237316195423570985008687907853269984665640564039457584007913129639935, or shown as "Unlimited."
[How to do it]: If you see this number, reject it immediately. It means the other party can transfer out all of that type of asset in one go.
[Done when]: You can confirm the authorization limit is a finite number close to your transaction amount, or at least within a range you can accept.
Check 2: Is the authorized party a contract you trust?
[What to do]: Look at the contract address—the "Spender" address you are authorizing.
[How to do it]: Copy this address and search for it on a block explorer. If it is an official contract of a well-known protocol like Uniswap or Aave, the record will have a verification badge or community tag. If you don't recognize it, or if it turns out to be a newly created address, just reject it.
[Done when]: You can clearly say who you are granting permission to, and that it is a protocol you actively intended to interact with.
Check 3: Is the token being authorized the one you actually want to use?
[What to do]: Check which token in your wallet the authorization request is targeting.
[How to do it]: If the signature screen shows you are authorizing the token you hold the most of, such as USDT, but you only intended to do a simple interaction, be suspicious—that does not make sense. Legitimate protocols usually only request permission for the specific token you are currently using, not all the tokens in your wallet.
[Done when]: The token in the authorization request matches the type of token you expected to use.
Step 3: Scan with the Wallet's Built-in Security Tools
[What to do]: Use the built-in security tools in the Binance Web3 Wallet to help you judge the risk. This is the easiest method.
[How to do it]: Open the menu in the top-left corner of the wallet homepage, go to Security Center, and tap Security Scan. The system will automatically check for you. If there is a risk, it will warn you before you sign.
[Done when]: The security scan shows green with no high-risk warnings. If it shows "unknown authorization" or "risky contract," cancel the operation immediately.
Risk warning: Some situations are very high risk—reject them immediately if you see them. For example, a page asks you to sign a request full of random-looking characters (a hash) but tells you it is just "login verification." Or you are only claiming an airdrop, but it asks you to grant "unlimited authorization" for an asset. These are typical phishing tactics.
The world's largest cryptocurrency exchange by trading volume,leading in security and liquidity.
New user benefit: Enjoy 20% off trading fees upon registration!
Step 4: What to Do If You Have Already Authorized a Suspicious Contract
[What to do]: Revoke the authorization.
[How to do it]:
In the Binance Web3 Wallet, go to Security Center → Permission Management or Authorization Security.
The system will list all your authorization records. Find the suspicious one, click the Revoke button on the right, and confirm the transaction signature to complete the revocation.
[Done when]: The suspicious record no longer appears in the authorization list.
How to verify the operation is complete: Enter your wallet address on a block explorer such as BscScan or Etherscan, switch to the "Token Approvals" tab, and confirm that the suspicious contract's authorization limit is now 0 or has disappeared entirely.
Next step: Make it a habit to check the authorization list in Security Center every month, and revoke any authorizations you don't recognize or no longer need. No matter who asks you to sign something you don't understand, don't click. If you can't understand it, assume it is a scam.
