Wallet Scanner
See instantly if any address has been delegated via EIP-7702 on Ethereum, Base, Arbitrum, Optimism, BNB Chain, Polygon or Avalanche.
Scan a walletOnchain transaction security
The second signature
that stops a hack.
On Oct 29, one bad signature drained a Binance hot wallet in 3 minutes. CryptGuard decodes, simulates and checks every transaction before it is signed, for your wallet or an exchange's hot wallets.
Protecting wallets onEthereumBaseArbitrumOptimismBNB ChainPolygonAvalanche
30sWatchlist check interval
7EVM chains, live RPC data
50+Risk checks per request
0Private keys ever requested
Incoming request · hot wallet "Binance 14"
"authorizationList": [
{ "chainId": 1, "address": "0xbad0…0000", "nonce": 81200 },
{ "chainId": 1, "address": "0xbad0…0000", "nonce": 81201 },
{ "chainId": 1, "address": "0xbad0…0000", "nonce": 81202 },
… 47 more pre-signed for future nonces
]
Co-Signer decision
Blocked
A critical pattern was detected. The Co-Signer refuses to sign.
BLOCK
- Critical50 pre-signed authorizations for future noncesRevocation-proof takeover: undo it and the attacker replays the next one.
- HighHands the account to contract 0xbad0…0000Whoever controls it can move everything the account holds, with no further signature.
Anatomy of the Oct 29 drain
Not a broken cryptography problem. A missing second check.
One signature had unlimited authority, nothing independent checked what it did, and nothing slowed it down. Bybit lost $1.5B the same way in February 2025.
- Oct 28
Funded through a mixer
0.1 ETH from Tornado Cash funds the attacker. A sweeper contract is deployed the next afternoon.
- 20:20:59 UTC
One authorization
An EIP-7702 authorization hands "Binance 14" to the attacker's contract. Early analysis points to manipulated signing infrastructure.
- Same tx
Undo blocked in advance
About 50 more authorizations, pre-signed for future nonces, make revoking it useless.
- 20:24:23 UTC
Swept in one transaction
167,464 ETH and 63 tokens leave at once. An outside analyst raises the alarm first.
Platform
One risk engine at every point where a signature happens
The same engine checks your wallet, your browser and your signing infrastructure. Every finding is explained in plain English.
Approval Checker
Every live token and NFT approval, ranked by risk, with fake spam-token approvals filtered out. Revoke in one click from your own wallet.
Check approvalsToken Check
Before you buy: we simulate a sell to catch honeypots, measure the tax, and list every power the owner holds, from minting to blacklisting.
Check a tokenSend Check
Before you send: catch address-poisoning lookalikes, fake $0 transfers and token-contract addresses that would swallow your funds.
Check an addressEmergency Kit
Hacked or drained? A guided response: see what the attacker can still do, move what is left, revoke, report and avoid recovery scams.
Open the kitSignature Inspector
Decode transactions, permits, Permit2, Safe batches and 7702 authorizations, then simulate them on a live chain before you sign.
Inspect a request24/7 Wallet Watch
Alerts within 30 seconds of a new delegation, approval or outflow. That includes funds leaving without a transaction from you, which only a takeover can do.
See ProPre-Sign Firewall
A browser extension that reads every request before MetaMask, Rabby or any wallet shows it, and stops drainers before you can click confirm.
See ProPolicy Co-Signer
An API your signing system must pass before it signs. It applies allowlists, velocity limits and attack-pattern blocks, and returns Ed25519-signed decisions you can verify.
Explore Co-SignerWhat changes with a Co-Signer
Each step of the attack meets a rule
| Attack step | Without CryptGuard | With the Co-Signer |
|---|---|---|
| Hot wallet delegated to an unknown contract | Signed automatically | BLOCK Delegation target not on allowlist |
| 50 authorizations pre-signed for future nonces | Revocation becomes useless | BLOCK Revocation-proof batch pattern |
| $2.8B swept in one transaction | Done in 3 min 24 s | HOLD Above per-transaction and 24h limits |
| Multisig DELEGATECALL disguised as a transfer (Bybit) | Signers approve what they are shown | BLOCK Independent decode shows the real call |
| Nobody internal notices | Outside analyst flags it | Alert within seconds, signed audit trail |
Pricing
Free for individuals. Infrastructure for institutions.
Free
$0
For anyone checking a wallet, a signature or a message.
Start free- Wallet scanner on 7 chains
- Token approval checker with revoke
- Signature inspector with simulation
- Scam checker with domain age
- 1 watched address, in-app alerts
ProMost popular
$12/month
For people with real money in self-custody. $99 billed yearly.
Get Pro- 10 addresses watched every 30s
- Telegram, Discord and Slack alerts
- Exchange alerts for exchanges you use
- Pre-Sign Firewall browser extension
- New-approval and outflow detection
Business
$499/month
For funds, DAOs, fintechs and market makers.
Start Business- Policy Co-Signer API
- Ed25519-signed decisions
- Allowlists, velocity limits, time-locks
- 50 addresses, 10 API keys
- Full audit log
Enterprise
Custom
For exchanges and custodians securing hot wallets.
Contact sales- Volume-based Co-Signer pricing
- On-prem / HSM deployment
- Exchange risk data feed
- 24/7 incident response
- SLA and security review
FAQ
Frequently asked questions
What happened in the Binance hack on October 29, 2026?
An attacker obtained a valid EIP-7702 authorization for the Binance hot wallet "Binance 14", pointing it at their own contract, plus about 50 pre-signed backups for future nonces. The wallet was swept 3 minutes 24 seconds later. Estimates range from $2.8B to $5.9B, with about $3B frozen. Read the full analysis.
What is an EIP-7702 delegation and why is it dangerous?
Since Ethereum's Pectra upgrade, a normal wallet can sign an authorization that makes it run a smart contract's code. Wallets use it for smart-account features. But if you, or a signing system, sign one for an attacker's contract, that contract controls everything in the account with no further signature. Check your address.
Does CryptGuard ever need my private key or seed phrase?
No. Every check uses public blockchain data and the request you paste. Revoking an approval is a normal transaction you confirm in your own wallet. Anyone asking for your recovery phrase is a scammer.
How is CryptGuard different from a wallet's built-in warnings?
Wallet warnings live inside the wallet that may itself be tricked, as in the Bybit and Binance incidents where signers saw something harmless. CryptGuard is an independent second opinion: it decodes, simulates and applies policy, and for businesses it is a second signature the signing system cannot skip.
Which chains are supported?
Ethereum, Base, Arbitrum, Optimism, BNB Chain, Polygon and Avalanche for scanning and monitoring. Simulation works on all of these except Avalanche. Approval history covers Ethereum, Base, Arbitrum, Optimism and Polygon, with BNB Chain and Avalanche where the data provider allows it.
Watch your wallet around the clock
A scan is a snapshot. The Binance drain took 3 minutes 24 seconds. CryptGuard checks your addresses every 30 seconds and alerts you on Telegram, Discord or Slack.