An approve costs nothing. That is the entire exploit.
On any given morning in this bull market, a Binance Wallet user opens a signing dialog that promises nothing. The gas estimate reads zero. There is no nonce to advance, no transaction hash to track, no block to confirm. The interface calls it verification. It is authorization. The user signs, sees no state change, and closes the tab. Ninety seconds later, a contract he never invoked reaches into an ERC-20 balance he believed was idle and moves it to an address he has never seen.
The transaction he was watching for never came. The signature was the transaction. This is the class of attack Binance Wallet now claims to intercept in real time โ and the promise is the interesting part, not the feature. When a platform that lost 7,000 BTC in a single 2019 breach announces it will now catch what its users cannot see, the forensic question is not whether it shipped. It shipped. The question is what the interception actually verifies.
I spent six weeks in 2017 auditing the Ethereum 2.0 Slasher protocol's proposer conditions by hand, and the lesson I carried out was not about slashing. It was that the dangerous condition is never the loud one. Silence in the slasher was the first warning sign. A silent signing dialog is the same warning wearing better UI.
The Four Cryptographic Surfaces Collapsed Into One Slogan
To understand what Binance shipped, you have to separate the feature from the marketing. The phrase "high-risk signature detection" collapses four distinct cryptographic surfaces into a single sentence, and the collapse is where users get hurt.
The first surface is EIP-2612. It extends ERC-20 with a permit function that lets a user authorize a spender by signing a message rather than broadcasting a transaction. The relay pays the gas. The user pays nothing โ until the approved spender exercises the allowance. The second is EIP-712, typed structured data signing, which renders in most interfaces as a familiar "sign to continue" even when the underlying payload is setApprovalForAll. The third is the literal setApprovalForAll call itself, which grants an operator control over every token in a collection with a single signature. The fourth is the marketplace layer โ Permit2, Seaport, and order-book signatures โ where a signed limit order can be filled immediately at a price the signer never intended to accept.
All four share one property: the user's economic cost of signing is zero, and the attacker's cost of execution is gas. That asymmetry is the entire game. A phishing campaign that requires the victim to pay gas selects for victims who read. A campaign that costs the victim nothing selects for everyone. In 2020, while deconstructing Curve's StableSwap invariant, I built a Python model showing that non-linear fee adjustments created hidden arbitrage for high-frequency traders โ the loss was borne quietly by liquidity providers who never saw the transaction that harmed them. Gasless signature phishing is the same structure at the user layer: the harm is real, the triggering act is invisible, and the victim's ledger shows nothing until it is too late.
Binance Wallet announced it has gone live with real-time detection and interception across these scenarios, with a stated roadmap to expand coverage. The announcement disclosed no detection engine, no false-positive rate, no coverage list, and no audit. That is not a small omission. For a security control, the absence of verifiability is itself a finding โ the proof is in the unverified edge cases.
Three Pipelines, Three Failure Modes
A production signature-interception stack is not one thing. It is three pipelines running at different timescales, and each fails differently.
The first layer is address reputation. A database of addresses associated with known drainers, mixer hops, and exploit contracts. This layer is fast, cheap, and structurally reactive. It knows only what has already been catalogued. A fresh drainer address, deployed this morning and funded through a new bridge, has no reputation at all. The layer's blind spot is not a bug; it is the definition of reputation. When I mapped the Ronin bridge exploit in 2022, the withdrawal address had no history at the moment of the first signature. Reputation systems are always fighting the last war. Ronin did not fail; it was engineered to trust โ and so is every reputation layer that treats "unknown" as "safe." A blacklist is a confession that you cannot detect, only remember.
The second layer is payload parsing. This translates EIP-712 structured data into a sentence a human can read: "You are authorizing 0xโฆ to transfer your USDC." Parsing is where the subtle work lives, because the danger is not in the fields the UI shows. It is in the fields the UI omits. A Permit payload carries owner, spender, value, nonce, and deadline. A parser that renders spender but not value: unlimited has produced a sentence that is technically true and operationally worthless. Nested structs, arrays of permits, proxy contracts whose owner field is not the signer โ each is a place where a correct parser of the wrong schema produces a confident lie. I have watched wallets render an accurate summary of the wrong object. The parser is only as good as its schema coverage, and schema coverage is defined by what attackers have already tried.
The third layer is transaction simulation. This is the strongest and the most expensive. A sandbox executes the post-signature state transition and diffs the user's balance before and after. If simulation is available, it catches drainers that reputation has never seen and parsers have never modelled โ because it does not care what the signature claims. It cares what the state does. This is the layer Rabby built its reputation on, and it is the layer most centralized wallets are still catching up to. Simulation has its own blind spots: signatures that require off-chain matching, conditional fills, cross-contract state that the sandbox cannot reconstruct without a forked state root pinned to the exact block.
Here is the part the announcement does not address. These three layers have different failure modes, and combining them does not average the failures โ it inherits all of them. A transaction can pass simulation and still be malicious if the malicious effect settles in a subsequent block. A payload can parse cleanly and still authorize an unlimited allowance. An address can be clean and still be the attacker, because reputation is a lagging indicator by construction. Concatenating three imperfect oracles does not produce a perfect one; it produces a system whose accuracy is the product of its parts, not the average.
Now the incentive math, because the entire security posture of a wallet is a response to it. An attacker chooses between two vectors. Vector A requires the victim to send a transaction; call the victim's friction cost f_A, high, because the user sees a gas estimate and a confirmation step. Vector B requires only a signature; call friction cost f_B, near zero. Under any model where victim detection probability scales with friction, the attacker's expected yield is:
E[yield] = p_success(value) โ cost
For Vector A, p_success is low because friction invites scrutiny. For Vector B, p_success is high because friction is absent. The attacker does not need a better exploit. The attacker needs a quieter prompt. The cost of the attack is not paid by the attacker; it is paid, invisibly, by the user's attention. When Binance says it will intercept "high-risk signatures," it is intervening at exactly the point where the attacker's economics are strongest and the user's attention is weakest.
That is a good thing. It is also a thing that has to be proven, not announced. A security control with an undisclosed detection engine is a control whose false-negative rate is unknown to the defender and โ more dangerously โ unknown to the attacker. In a bull market, the announcement itself is material: users migrate to the wallet branded "safe." In a bear market, the interception rate is material. We are in the former, which is why the announcement arrives now.
Consider what a rigorous disclosure would contain. Engine provenance โ self-built or vendor-integrated. Coverage โ EIP-2612, EIP-712, setApprovalForAll, Permit2, and which chains each spans. Accuracy โ false positives per thousand legitimate signatures, false negatives on a public adversarial corpus. Recovery โ what happens when a user is wrongly blocked, and who adjudicates. Binance disclosed none of these. I am not accusing Binance of building a bad control. I am stating that the control is unfalsifiable as shipped, and unfalsifiable security is retail theater dressed as engineering.
When the math holds but the incentives break, the break is where the loss happens. The incentive here is straightforward: a CEX with a Web3 wallet needs user trust to migrate volume on-chain, and a single high-profile drain through its own UI would be catastrophic to that migration. Interception is therefore rationally motivated. Rational motivation, however, is not the same as correct implementation. The Ronin bridge was rationally motivated too โ its validators were meant to be trusted. That design choice was immune to code review because the flaw lived in the trust model, not in the arithmetic.
There is a second-order problem that adding more scenarios cannot solve. Detection is centralized. A user cannot inspect why a signature was judged safe, and cannot meaningfully appeal a decision to block it. Rules update on Binance's schedule, against Binance's threat intelligence, under Binance's definition of "high-risk." That is a single point of interpretation sitting between the user and every DeFi protocol the user touches. Complexity is not a shield; it is a trap โ and the trap is that the user now has less reason to read the payload themselves. The wallet has read it. The wallet has decided. The user has outsourced the one act โ verification โ that cannot be outsourced without transferring custody of judgment.
From a systems perspective, the wallet is becoming a policy engine. That is architecturally interesting and adversarial by nature. Attackers will not stop writing phishing prompts; they will write prompts designed to look like Binance's detection is working while the drain proceeds through a path the rules do not cover. Multi-step approvals. Split permits kept below a heuristic threshold. Time-delayed fills that pass simulation and execute later. Every detection rule is a specification, and every specification invites a compliant attack. This is the same arms race I worked through on the zero-knowledge side in 2026 โ a patched circuit is secure until someone attacks the assumption that the patch encodes. Here, the assumption is that risk is a property of the signature. It is not. Risk is a property of what happens after.
The Theater of Displaced Vigilance
The counter-intuitive claim is this: the more credibly a wallet markets its interception, the larger the population of careless signatures it produces. Security theater is not the absence of security; it is security that displaces vigilance. If a user believes the wallet will catch the drain, the user stops reading the spender field. The wallet's detection becomes the user's reasoning. That works until it does not, and it does not at the exact moment the attacker probes the uncovered edge case โ which is precisely the moment that matters most.
I have watched this pattern before, at the protocol layer. A centralized sequencer markets itself as fast and cheap; users stop verifying finality assumptions; the assumption fails at the worst possible time. Layer 2 is merely a delay in truth extraction. A signature firewall is merely a delay in signature autopsy โ the truth arrives when the funds move, not when the prompt closes.
The uncomfortable conclusion is not that the feature is useless. It is that a client-side interception cannot be the primary defense and should not be marketed as one. The primary defense is, and remains, the user reading the payload or refusing to sign anything they cannot fully parse. Any product that makes that act feel unnecessary is trading a small reduction in average loss for a large increase in tail loss โ and tail loss is the only loss that ends a wallet.
Where This Lands
So the right question is not whether Binance now intercepts dangerous signatures. It does, in some unequipped fraction of cases. The right question is what the false-negative rate is under adversarial testing, and whether it will be disclosed before the next headline drain. A security control that ships without a public adversarial corpus is a claim, not a guarantee. The proof is in the unverified edge cases โ and Binance has, so far, declined to publish them.
My forward judgment: within twelve months, signature simulation will be table stakes rather than a differentiator, and the wallets that survive will be the ones that publish their miss rates, not the ones that announce coverage. The market rewards the announcement today. The chain rewards the corpus tomorrow. The only open question is which one the next victim will have trusted.