End Blind Signing: What to Check on Your Hardware Wallet After the Trezor Update

When your hardware wallet shows you nothing but a string of hexadecimal characters before you approve, you are signing blind. That is changing for part of your transactions: on September 7, 2026, Trezor switched on a feature called Clear Signing, which translates contract data into readable sentences on the device display. cryptoticker.io collected the analysis below on September 9, 2026, and it shows how far the coverage really reaches: of the twenty largest Ethereum applications by capital deposited, exactly two are on the plain-text list at launch.

For you that means two things. The most important step is a firmware update, and there is nothing else to configure. The second step concerns everything the new standard does not yet cover, and that is the larger part of your everyday life in decentralised finance.

Blind signing: what you approve when you confirm a hexadecimal string

Blind signing describes the approval of a transaction whose content the device does not display in plain language, showing only a block of data or a checksum. In that case the wallet knows that it is signing something, but it cannot tell you what.

Until now the sequence looked like this. On your computer sits a comprehensible sentence, say the swap of 2,000 dollar tokens for ether. Only the so-called calldata block travels to the device, meaning the encoded function together with its parameters. A character string appears on the small display. You confirm and trust that the sentence on the large screen matches what the device is signing at that moment. In its own blog post, Trezor explicitly describes this sequence as an inversion of the principle: the wallet is supposed to be the last authority, not the computer.

Why the wallet screen has to be the last authority

A hardware wallet protects your private key and signs offline. The third layer of protection, a check on a trustworthy display, falls away when the string is unreadable. If the computer is compromised or a provider's website has been manipulated, the browser still shows you the harmless sentence while the block of data does something else. Wallet drainers and swapped interfaces live off that gap. Trade publications such as Cryptobriefing and Cryptopolitan assign the theft at the Bybit exchange in February 2025, with damage of around 1.5 billion dollars, to the same class of attack.

The gap is not a theory out of security research. As recently as August 25, 2026, we reported on a signature flaw in Ledger's Ethereum app, where the display on the device and the content actually signed could come apart. Anyone looking only at the computer screen at the time would not have noticed the difference.

Trezor Clear Signing: what was switched on for September 7

In its own blog, Trezor calls Clear Signing the flagship security feature of 2026. Instead of a checksum, the device shows the actual action for supported contracts, the tokens involved, the amounts and the destination address in ordinary language. The trade press picked up the launch on September 8; Cryptobriefing reports that the Ethereum Foundation has confirmed the implementation and that Trezor worked with its competitor Ledger on it.

Three points from the announcement matter in practice. First, there is no switch: the feature takes effect automatically through Trezor Suite, WalletConnect and Trezor Connect as soon as the firmware is current. Second, it only covers contracts for which a matching description file exists. Third, for everything else the device falls back on the old sequence together with a warning.

The feature concerns Ethereum and the networks compatible with it, so the common layer 2 chains as well. Nothing changes for plain bitcoin transfers, because there the recipient address and the amount already appear in plain text on the display.

Which Trezor models show plain text and which one misses out

According to the manufacturer's blog, the Safe 7, Safe 5 and Safe 3 models and the older Model T support the feature, provided they run the standard firmware with Ethereum support. The Model One is left out. That is not an edge case, because the device has been on sale since 2014 and is likely to be sitting in a good many drawers.

If you use a Model One and work with contracts regularly, you now face a permanent limitation. Either you restrict the device to simple transfers and holdings you rarely move, or you plan a switch. Which criteria count there, and why a manufacturer's reputation alone is a poor basis for a purchase, is set out in our comparison of hardware wallets.

A note for context: even a manufacturer with a good security reputation has weak points elsewhere. In September 2026, Trezor customers had to check whether their address details were affected by a data breach at a shipping service provider. Plain text on the display does not solve that problem.

ERC-7730: the open standard behind the plain-text display

ERC-7730 is an open standard that gives wallets a uniform rule for translating complex contract data into readable information. Every supported contract comes with a description file, a so-called descriptor, which sets out which function produces which sentence. The specification is publicly available, and Trezor has made its own implementation open source, firmware and decoding logic included.

The decisive sentence for your everyday use is in the manufacturer's list of questions: coverage follows the register of these description files. No entry, no plain text. At launch Trezor names 1inch, Aave, Lido, Tether, LiFi and Hyperliquid along with further contracts. Cryptobriefing reports that the number of published description files grew by around 28 percent between the introduction in May 2026 and the end of July.

Our analysis: how much DeFi capital plain text reaches at launch

We wanted to know what those six names mean in practice, so we counted for ourselves. The basis is the public interface of DefiLlama, called on September 9, 2026 at around 22:00 UTC with code 200. We evaluated the capital deposited on Ethereum per application, adjusted for centralised exchanges, for chains themselves and for the official bridges of the networks, because nobody approves a contract there that a device would have to display.

The result: the twenty largest applications on that adjusted list carry 115.7 billion dollars between them. Two of them are on the launch list of the plain-text register, namely Lido with 23.90 billion and Aave in its third version with 14.58 billion. That comes to 38.5 billion dollars, or 33.3 percent of the capital in this selection.

A third sounds like little and is still the strongest part of the market: the two largest pools of all are covered. Anyone lending or staking ether will therefore see readable information on the device for the two most common routes.

Why Uniswap and Curve are not on the launch list

The other side of the count is the more interesting one. Among the applications with no mention at launch sit the very trading venues that many investors use daily. For Uniswap the interface reports 0.90 billion dollars in version three, 0.84 billion in version two and 0.69 billion in version four; Curve comes to 1.21 billion. None of those contracts belongs to the six names on the launch list.

Measured by capital deposited, these addresses sit far behind the lending and staking pools. Measured by the number of approvals it is the other way round: a swap regularly consists of two signatures, an approval for the token and the swap itself. Expensive mistakes happen in exactly that accumulation, and that is exactly where the old sequence remains in place for now.

That puts the announcement in perspective without devaluing it. The standard is open, the register is growing, and other manufacturers are building on the same foundation. Until then the rule that applied before September 7 still applies to you: what you do not read, you do not approve.

How to check in five minutes what your device really shows

The test costs no fee and needs no transaction. Connect your device to the manufacturer's management software and look whether newer firmware is offered. Install it while your recovery phrase is within reach, and note the version number before and after the update.

After that, call up an application you use anyway and start an approval that you cancel at the end. What counts is the moment the device asks for your confirmation. If the action, the token, the amount and the destination address appear there in words, plain text is working. If you see a character string or a note about an unknown block of data, the contract is not in the register.

In the same run, check the destination address character by character, at least the first and the last six digits. The reason lies in a widespread trick: attackers send you tiny amounts from an address that looks deceptively similar to the recipient address you are used to, hoping you will later copy it from your history. How to spot such deceptions is set out in our article on phishing around crypto withdrawals.

What plain text explicitly does not prevent

A readable display answers the question of what you are signing. Whether the contract behind it is reputable is a question nobody answers on the display. An unlimited approval for a fraudulent contract remains an unlimited approval, even when the device describes it cleanly. Nor does the standard help against a lost recovery phrase, against a poorly secured software wallet on an infected computer, or against pressure from outside.

What to do when the blind signing warning appears

The warning does not report an error. There is simply no description available for this contract. Cancel at that point if you do not know the counterparty. With an application you trust, at least check the contract address against the provider's official documentation instead of taking it from a search engine or a message.

Two habits lower the risk regardless of the device. Keep amounts separate: one account for daily dealings with contracts, a second for the holdings that never belong there. And limit approvals to the amount you currently need instead of confirming the preset unlimited permission. Both take effect immediately and cost you only a few extra clicks.

Limits of this analysis: what our figures do not show

Our measurement describes capital deposited, not usage. How many approvals go to which contracts each day does not follow from it, and that figure would say even more about the question of coverage. The survey also rests on a single data source, which we did not mirror against a second one in the same minute.

We did not count the register of description files. We held the launch partners named by the manufacturer against the capital ranking. Alongside the six names, Trezor explicitly mentions further contracts without listing them; actual coverage may therefore be higher than our allocation of two hits in the first twenty places. Finally, we look only at Ethereum. On the layer 2 chains, for which the feature also applies, the ranking looks different.

In time, the analysis is a snapshot of September 9, 2026. If the register keeps growing at the pace of the months from May to July, the picture shifts in favour of plain text, and the section above ages quickly. The recommendation is unaffected by that.

Checking blind signing: what to take away

1. Update the firmware and establish where your model stands. Safe 7, Safe 5, Safe 3 and Model T get the plain-text display, the Model One does not. If your device is left out and you approve contracts regularly, look at the criteria in our hardware wallet comparison before you buy a new one.
2. Start an approval as a test and cancel it again. That shows you, on your own holdings, which of the applications you use appear in plain text. For everything else the old rule stands: check the contract address first, then confirm. If you are travelling without a device, the security-relevant differences are in our comparison of software wallets.
3. Separate holdings and limit approvals. Keep your long-term holdings away from the account you use to sign contracts daily, and set approvals to the amount needed rather than to unlimited. Which devices support that, and with how much handling effort, is likewise in the hardware wallet comparison.

The announcement of September 7 is a genuine step forward for the two largest pools of capital in the Ethereum world. For the rest of your everyday use, responsibility stays where it has always been. The full announcement is in the manufacturer's blog post, and the specification of the standard in the official ERC-7730 version.

(As of September 9, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)