Admin EOA signing from new geography/device
A real-time signals factor in the v1.7.0 rubric. Measured per protocol on a rt cadence.
Methodology how we score#
What this measures
This real-time signal fires when the admin or upgrader EOA signs a transaction from a geography (as inferred from IP metadata, if observable) or device fingerprint inconsistent with the prior signing history for that address. This signal is off-chain in nature — it requires access to signing telemetry from the wallet provider or a relay — and is therefore M (manual) curation and P2 priority. Category 6 context: geography and device anomalies are the off-chain behavioral indicators of key compromise, particularly relevant for the class of exploits where the attacker physically compromised a signing device or intercepted signing credentials.
Why it matters
Radiant Capital II ($53M, 2024) involved what Radiant described as a sophisticated device-level compromise across three signers' hardware wallets — an attack that left no on-chain precursor signal but would theoretically have been detectable via signing-session fingerprint anomalies if those signers' device environments were monitored. EasyFi ($59M, 2021) involved a MetaMask compromise that exposed private keys. The Harmony Bridge compromise involved hot-wallet signers whose key exposure would have been preceded by an anomalous signing session. The signal is P2 because signing-session telemetry is not broadly accessible from protocol-external monitoring — it requires cooperation from wallet providers or relay operators.
Green / Yellow / Red
Green is the baseline when all admin signing sessions show device fingerprints and network characteristics consistent with the established signing history for each admin address. Yellow fires when a signing session shows an unfamiliar device fingerprint but from a consistent geography — could indicate hardware upgrade. Red fires when an admin signing session originates from an entirely new geography and device fingerprint combination never previously associated with that address.
Common gray cases
Gray applies in virtually all v1 monitoring cases where signing telemetry is not accessible from the dashboard's external vantage point — this is the norm and Gray is the expected baseline state for most protocols.
Notable historical examples
No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for#
Detect whether an admin/upgrader EOA signs from a geography or device fingerprint inconsistent with prior signing history.