Crypto wallet signature scams#

Last modified: August 10, 2026

A wallet signature can authorize a transfer, approval, trade, or account permission even when no password or recovery phrase is requested. Signature scams trick you into approving an action that benefits the attacker, often through a cloned site, fake claim, urgent warning, or support message.

On Centurion, always confirm that the wallet request is for the intended network, chain ID 286, and action you started yourself.

How signature scams work#

Wallet requests fall into several broad categories:

Transactions: on-chain calls that can transfer CTN, move CRC-20 tokens, approve a spender, authorize a CRC-721 or CRC-1155 operator, or change a smart account.
Message signatures: off-chain signatures that may prove account ownership, accept terms, create an order, or authorize a later on-chain action.
Typed-data signatures: structured messages intended to be more readable, but still capable of granting valuable authority.
Permit-style signatures: messages that can approve token spending without a separate approval transaction when supported by the token, wallet, or tool.
Smart-account permissions: session keys, modules, delegates, or batched calls that can remain active after the first interaction.

A request showing zero CTN value is not automatically safe. It can still grant a contract permission to transfer CRC-20 tokens or NFTs later.

What it looks like#

You visit a page that claims to check whether your wallet is eligible for a refund. Your wallet shows a request with zero CTN being sent, so it appears safe. In the details, the request gives an unknown spender permission to move all of one CRC-20 token. Minutes later, your token balance drops because the attacker used the permission you approved.

Common attack patterns#

Attackers often use:

Fake token claims, refunds, migrations, or security checks.
Search ads leading to cloned CenturionDEX pages.
Direct messages from fake Centurion Labs staff.
QR codes that open a signing page.
A harmless-looking sign-in followed by a broad approval.
Wallet-drainer pages that select the most valuable permission available.
A batch that hides an approval among ordinary-looking calls.
Permit or Permit2-style wording to make an approval look like a login.

Modern wallets may simulate outcomes, but simulation can be incomplete when contracts are upgradeable, state changes before execution, or the request uses an unfamiliar signature format.

Step-by-step before signing#

Confirm that you reached the site through a current official Centurion source.
Verify the wallet is on Centurion and shows chain ID 286 when that detail is available.
Read whether the request is a transaction, message, typed-data signature, permit-style approval, or smart-account permission.
Inspect token contracts, spender or operator, allowance amount, recipient, and expiry.
Expand every action in a batch or smart-account permission.
Cancel if the wallet cannot explain the effect or the request does not match the action you initiated.
Use a separate low-value wallet for unfamiliar applications.

If you already signed#

Stop interacting with the site and preserve the page name, screenshots, and transaction hashes.
Review CRC-20 allowances, NFT operator approvals, permit-style permissions, and smart-account permissions on Centurion.
Remove malicious permissions through a trusted Centurion-compatible tool.
If a private key or recovery phrase was exposed, create a new wallet on a clean device and move remaining assets.
Report the incident through official Centurion channels and appropriate authorities.

Disconnecting the site is not enough because on-chain permissions remain until revoked or exhausted.

Stay safe#

Never share a recovery phrase, private key, password, or hardware-wallet code. Verify every signature, even when the request appears to come from support or promises a benefit. No legitimate CenturionDEX recovery process requires a surprise wallet approval.