When you log in with a wallet, the signature request that pops up is a piece of structured text, not an on-chain transaction. Its purpose is to let you "stamp" with your private key and prove to the website that "I control this address." The signature itself does not move assets or cost gas. But that is exactly where the problem lies: many people habitually click confirm when they see the word "sign," and phishing sites take advantage of this by getting you to sign something that looks like a login but actually authorizes moving your assets.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
What Fields Are in a SIWE Message and What Do They Do
SIWE (Sign-In with Ethereum, also known as EIP-4361) defines a standard format. Wallets parse the content into a human-readable interface based on this format. Before signing, you mainly need to check these fields:
domain. This is the core anti-phishing mechanism of SIWE. The specification requires wallets to compare the domain in the message with the actual origin of the request. For example, if you click login on app.uniswap.org, the message should start with app.uniswap.org wants you to sign in with your Ethereum account:. If the domain does not match, the signature request may not be from the website you are visiting.
address. Confirm that this is the wallet address you are currently using. If you have connected multiple addresses, make sure you are signing with the one you intend to use for login.
statement. This is a human-readable explanation, usually something like "I accept the Terms of Service." Its purpose is to help you understand what this signature is for. If the text says something strange, such as "authorize transferring all assets," stop and think carefully.
nonce. Each login request should include a unique random number to prevent replay attacks. If a website repeatedly uses the same nonce, or has no nonce field at all, it may not have implemented SIWE correctly.
issued-at and expiration-time. The issuance time and expiration time of the signature. Expired messages should not be accepted.
How to Tell If a Signature Request Is Safe
After MetaMask supports SIWE, it does two things with the message: parse the fields and show them to you, and check the domain binding. But the wallet will not block all risks for you.
First check whether the domain matches. MetaMask will show a warning when the domain does not match, but it will not force you to stop signing. This means that if you ignore the warning and click confirm anyway, the signature will still be completed. A phishing site can easily generate a message whose domain field is its own website domain, tricking you into signing for an unfamiliar domain without realizing it. So checking the domain is something you need to do yourself: which website are you visiting, and is the domain in the message exactly that website?
Then look at the message type. SIWE messages have a fixed format: they usually start with the domain plus "wants you to sign in with your Ethereum account:", followed by structured fields such as address, statement, nonce, and timestamps. If the popup content is a large block of JSON, a string of hexadecimal code, or looks like a request for "authorization," "transfer," or "Permit," then it is not a SIWE login and should be treated as a transaction or approval request.
Check for unusual urgency. A normal login signature will not require you to complete it within seconds, nor threaten that "your account will be frozen if you do not sign." If the page has a countdown or repeatedly urges you, step back and verify whether the website is real.
What a Phishing SIWE Request Might Look Like
The most direct attack is faking the domain. An attacker registers a domain that looks very similar to a legitimate website, such as writing metamask.io with Unicode variant characters. On this fake website, the domain field of the SIWE message shows the fake domain, but if you do not look carefully, you may think you are logging in on the real website.
Another method exploits users' lack of understanding of the signature mechanism. Some phishing sites do not fake the domain. Instead, they use a legitimate domain to get you to sign, but embed malicious content in the statement or additional fields of the message. The resources field in EIP-4361 can be used to specify resources involved in the signature. If the wallet does not display this field correctly, you may not know what the signature actually authorizes.
There is also a case where an attacker tampers with the signature request on a legitimate website through XSS (cross-site scripting) or a malicious library. If a dapp's SIWE implementation has a vulnerability, an attacker may inject a signature request they control when other users visit the site.
If You Have Already Signed a Suspicious Request
The signature itself will not immediately move your assets. If you suspect you signed an unsafe SIWE message, you need to determine what exactly you signed.
If what you signed is indeed just a login message that follows the SIWE format, and the domain is a website you trust, with no fields authorizing asset transfers, then the actual risk of this signature is very low. What the attacker gets is only a signature proving that you control the address, and they cannot directly use your assets.
If what you signed is not standard SIWE but a transaction, approval, or Permit signature, the situation is different. A Permit signature can allow an attacker to move specific tokens without initiating an on-chain transaction. An approval signature grants a contract permission to operate your tokens. Once these two types of signatures are maliciously exploited, assets may be moved without any action on your part.
What you can do at this point is: open the wallet's "connected sites" or approval management page and revoke approvals you no longer need. If you suspect your private key or seed phrase has been leaked (for example, if you entered it on a phishing site), move your assets to a new wallet.
A Practical Checking Habit
Before signing, spend a few seconds looking at two things: whether the domain in the message matches the domain in your browser's address bar, and whether the format of the message looks like the login style you are familiar with, rather than a string of unreadable hashes or JSON. MetaMask and other wallets that support SIWE have turned standard-format messages into relatively friendly interfaces. If the popup content looks different from your usual login, cancel first.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
References
- MetaMask·MetaMask Developer and SpruceID Collaborate to Implement EIP-4361, published or updated: 2024-03-27; verified: 2026-09-27.
- eips.sh·ERC-4361: Sign-In with Ethereum, published or updated: 2021-10-10; verified: 2026-09-27.
- Ethereum EIPs·eip-4361.md, no update date indicated; verified: 2026-09-27.
- Ethereum EIPs·eip-4361.md, no update date indicated; verified: 2026-09-27.
- Ethereum EIPs·eip-4361.md, no update date indicated; verified: 2026-09-27.
- Sign-In with Ethereum·Security Considerations, no update date indicated; verified: 2026-09-27.
- Coinbase Developer Documentation·Sign In With Ethereum, published or updated: 2026-09-17; verified: 2026-09-27.
- MetaMask Docs·Use Sign-In with Ethereum, no update date indicated; verified: 2026-09-27.
- PhishDestroy·xn--metamasklogin-lobs.webflow.io: Fake MetaMask Login Crypto, published or updated: 2026-06-12; verified: 2026-09-27.
- Internet Computer Developer Forum·Security Advisory: Sign-In with Ethereum/Bitcoin/Solana (SIWE/B/S) prone to Phishing, published or updated: 2026-02-10; verified: 2026-09-27.
