How to Spot Abnormal Change Outputs When Signing on Hardware Devices: A PSBT Checklist
The key to detecting abnormal change outputs when signing on a hardware device is to verify that the change output in the PSBT uses the same derivation path as your input sources. In a normal transaction, the change output carries descriptor path information for the signer to verify; an abnormal change output often lacks a path, has an inconsistent path depth, or has an excessively large index gap, directly exposing a tampering attempt.
1. Before Signing, Confirm: Is This Output a "Payment" or "Change"?
Step 1: Locate the change output in the PSBT
What to do: Open the PSBT file and find the output that belongs to you within the outputs[] array.
How to do it:
Case A (wallet software can view it): Use a wallet that supports PSBT previews (e.g., Sparrow Wallet), open the transaction details, and look at the output list to see which ones are "To" addresses (payments) and which are labeled "Change". The change output will typically show a new address generated by your wallet.
Case B (command line or text view): Read the PSBT in JSON or text format directly; in the outputs field, the output with bip32_derivs information is very likely the change (only change outputs carry a complete derivation path; external payment outputs generally do not).
When it's done: You clearly know which output in this transaction is the change returning to you.
2. Check the Change Output's Derivation Path (Core Defense)
The essence of an abnormal change attack is tampering with the derivation path in the PSBT, pointing the change that should return to your wallet to a path you cannot control.
Step 2: Check if the change output carries the bip32_derivs field
What to do: In the PSBT change output, look for bip32_derivs information.
How to do it:
Case A (bip32_derivs present): Proceed to Step 3 to verify that the path matches your wallet's descriptor.
Case B (no bip32_derivs): This is a strong warning signal. If this is a change output but the derivation path is missing, the hardware device cannot verify whether this address truly belongs to you. Some devices will display a "Change Fraud" or "找零欺诈" warning.
When it's done: You confirm whether the change output has bip32_derivs information.
Step 3: Verify the correctness of the derivation path
What to do: Check whether the path in bip32_derivs (e.g., m/84'/0'/0'/1/4) matches your wallet descriptor format.
How to do it: Pay special attention to the following indicators:
Path depth consistency: The derivation path length of the change output must be the same as the derivation path length of your input UTXO.
Hardened/non-hardened pattern consistency: The distribution of hardened indices (the ' in the path) should remain consistent.
The second-to-last index is 0 or 1: According to BIP44, the second-to-last position in a change path is typically 0 for external addresses or 1 for internal/change addresses; /1/ is the common location of change addresses.
The last index is within a reasonable range: A normal change address index usually does not differ too much from the input address index (usually not more than 200).
Path depth does not exceed 12 levels: A path deeper than 12 levels should be considered suspicious.
When it's done: All indicators pass verification, and the path appears "normal" rather than "deliberately constructed."
Prerequisite: You already have a backup of the wallet's descriptor. Without the descriptor, you cannot independently verify locally whether the change output truly belongs to you. The descriptor is the "blueprint" of your wallet, recording the derivation rules for all addresses.
3. Hands-on Verification on the Signing Device
Step 4: Verify each output address and amount on the hardware device screen
What to do: Before signing on the hardware device, carefully look at each output address and amount displayed on the screen.
How to do it: If the device shows a "Change Fraud" warning or "Troublesome Change Outs," immediately abort signing. This indicates the device has detected an abnormal change path. Note the expected path displayed by the device versus the actual path, and compare the differences.
When it's done: The change address shown by the device matches the expected address you previously recorded, and no change-related warnings appear.
Common Failure Reasons
"The hardware device detected Change Fraud, but I think the transaction is fine" — In a multi-sig wallet, if one of the participants uses a wallet with a different format, the generated change path format may be inconsistent, causing the hardware device to mistakenly flag it as abnormal. Coldcard's documentation explicitly mentions that this situation "may have false positives," requiring you to manually confirm and choose to proceed — provided that you really know where this change will go and do not blindly click through.
Risk reminder: The prerequisite for an abnormal change attack is that the attacker has obtained your XPUB. The XPUB itself cannot move your funds, but combined with a tampered PSBT, it can direct the change to an extreme path—while your private keys can still control that address, you do not know what the path is, meaning you can never recover it. It is recommended that XUBs be transferred only between trusted devices and wallet software, and not transmitted through unencrypted channels.
After completing these checks, how can you confirm the change is safe?
The simplest method: Use your descriptor to independently derive the change address for the current transaction in offline wallet software, then compare it character by character with the change output address in the PSBT. If they match, the change has not been tampered with. If you find that the addresses do not match, or you cannot find the descriptor to verify — do not sign. First confirm where your descriptor backup is, then proceed.
