Admin EOA signing from new geography/device
A real-time signals factor in the v1.7.0 rubric. Measured per protocol on a rt cadence.
Methodology how we score #
**What this measures** This real-time signal fires when the admin or upgrader EOA signs a transaction from a geography (as inferred from IP metadata, if observable) or device fingerprint inconsistent with the prior signing history for that address. This signal is off-chain in nature — it requires access to signing telemetry from the wallet provider or a relay — and is therefore M (manual) curation and P2 priority. Category 6 context: geography and device anomalies are the off-chain behavioral indicators of key compromise, particularly relevant for the class of exploits where the attacker physically compromised a signing device or intercepted signing credentials.
**Why it matters** Radiant Capital II ($53M, 2024) involved what Radiant described as a sophisticated device-level compromise across three signers' hardware wallets — an attack that left no on-chain precursor signal but would theoretically have been detectable via signing-session fingerprint anomalies if those signers' device environments were monitored. EasyFi ($59M, 2021) involved a MetaMask compromise that exposed private keys. The Harmony Bridge compromise involved hot-wallet signers whose key exposure would have been preceded by an anomalous signing session. The signal is P2 because signing-session telemetry is not broadly accessible from protocol-external monitoring — it requires cooperation from wallet providers or relay operators.
**Green / Yellow / Red** Green is the baseline when all admin signing sessions show device fingerprints and network characteristics consistent with the established signing history for each admin address. Yellow fires when a signing session shows an unfamiliar device fingerprint but from a consistent geography — could indicate hardware upgrade. Red fires when an admin signing session originates from an entirely new geography and device fingerprint combination never previously associated with that address.
**Common gray cases** Gray applies in virtually all v1 monitoring cases where signing telemetry is not accessible from the dashboard's external vantage point — this is the norm and Gray is the expected baseline state for most protocols.
**Notable historical examples** No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for #
Detect whether an admin/upgrader EOA signs from a geography or device fingerprint inconsistent with prior signing history.