Incident Review: Phishing Signature Attempt and Containment

Incident Summary

On February 21, a team wallet received a signature request from a lookalike domain mimicking a known protocol. The request looked routine, but calldata intent and domain fingerprint did not match the official integration profile.

The signer paused, escalated, and no malicious transaction was signed.

Detection Signals

Three indicators triggered containment:

• Domain variation from expected canonical URL
• Signature prompt requested broad permission unrelated to user action
• Destination contract was not in the team's approved spender registry

Containment Timeline

T+0 to T+10 minutes

• Signer rejected prompt immediately
• Captured screenshots and wallet prompt details
• Notified security channel with event metadata

T+10 to T+30 minutes

• Validated suspected domain against prior allowlist
• Cross-checked contract address ownership and creation history
• Flagged affected browser profile and device session

T+30 to T+90 minutes

• Rotated operational browser session
• Re-ran approvals audit on all related wallets
• Published internal incident notice and temporary signing freeze

Evidence Appendix

Collected Artifacts

• Suspicious domain screenshot and URL diff notes
• Wallet prompt screenshot with signature request payload
• Contract address lookup result and creation timestamp

Sample Evidence Record (redacted)

event_id: IR-2026-02-21-01
wallet: 0xA1b2...9F3d
suspected_spender: 0x5cD7...dA91
action_taken: rejected_signature_and_escalated

Root Cause Analysis

The primary weakness was not wallet security itself, but workflow drift:

• One contributor bypassed bookmark-only access and used a search result
• No hard check existed for domain mismatch before signing
• Spender allowlist verification was recommended, but not enforced

Corrective Actions

1. Mandatory pre-sign checklist with domain and spender validation
2. Bookmark-only policy for all production signing flows
3. Two-person review for any approval request above threshold
4. Daily sync of approved spender registry by chain

What Worked Well

• Fast human escalation prevented unsafe signing
• Existing response channel reduced confusion
• Weekly audit baseline made verification faster

What We Improved

• Added clearer runbook for phishing-like signature prompts
• Added evidence template for better incident documentation
• Reduced mean response time target for future events

Conclusion

This incident reinforced a critical point: most wallet incidents are process failures before they are cryptography failures. A repeatable review workflow is the strongest control layer.