Signing a message is how you prove you own a wallet without moving any assets. Decentralized applications (dApps) use it constantly, for example, an airdrop platform might ask you to sign a message just to confirm you own the wallet address that's eligible. This is normal and useful, but it also creates an opening scammers can exploit.

On-chain signing authorizes an action that changes something on the blockchain, like transferring assets or executing a smart contract. Your wallet handles this automatically in the background whenever you approve a transaction, so you rarely interact with it directly.

Off-chain signing, often just called message signing, doesn't change anything on the blockchain. It's mainly used to prove ownership of a wallet, like logging into a dApp. This is the type of signing most Web3 users interact with regularly, and it's also the type scammers try to exploit.

Not all signing methods carry the same risk. The eth_sign method lets you sign any message in a raw, unreadable format, with no context about what you're actually agreeing to. That makes it easy for scammers to disguise a malicious authorization as a routine step in a legitimate-looking process. Safer methods, like personal_sign and eth_signTypedData, add context and structure to what you're signing, which makes it much clearer what you're actually authorizing.

Scammers set up fake websites or dApps that look legitimate, then create urgency to get you to act fast, like a limited-time airdrop or a reward that's about to expire. When you connect your wallet and sign the message they ask for, you may think you're just verifying your identity or claiming a reward. In reality, the message can authorize the scammer to move assets out of your wallet. Common versions of this scam include fake airdrops, cloned dApps, fake NFT minting pages, and phishing emails, all designed to get you to sign something you don't fully understand.

What makes this particularly effective is that Web3 users are used to signing messages to prove their identity or approve routine actions, so a malicious request can blend right in.

Binance.US Wallet bans the eth_sign function entirely. If a transaction tries to trigger it, you'll get an immediate warning that the request is highly risky, and the transaction won't be able to go through.

Only connect your wallet and sign messages on platforms you trust, and treat unsolicited airdrops or rewards with skepticism, especially ones that pressure you to act quickly. Before connecting to any dApp, double-check the URL carefully, since scam sites often use addresses that look nearly identical to the real thing. Use a wallet that protects against risky signing methods, and stay current on the scam patterns making the rounds in Web3.

Message signing is a normal part of using Web3, but it's also one of the easiest things for scammers to disguise. Slowing down before you sign, checking the platform you're on, and using a wallet with built-in protections goes a long way toward keeping your assets safe.