Safe Wallet Signer Monitoring: Alerts, Health Checks, and Detecting Compromised Keys

A multisignature wallet’s strength lies not in its smart contract design alone, but in the continuous oversight of who holds approval authority. Safe Wallet, formerly Gnosis Safe, distributes signing rights across multiple wallets, yet each signer remains an individual security perimeter. If one key is compromised, the threshold requirement limits immediate damage—but only if the compromise is detected before a second signer approves a malicious transaction. Real-time monitoring and systematic health checks are therefore not optional features for security-conscious teams. They are operational requirements for any organization managing meaningful digital assets through multisig custody.

The monitoring challenge is structural: Safe Wallet enforces transparent, on-chain transaction approvals, meaning every proposal and confirmation is visible to all signers and external observers. That transparency cuts both ways. It prevents hidden approvals and ensures that a signer cannot unilaterally move funds, but it also creates a continuous stream of data that teams must actively watch. Without systematic alerting, log review, and baseline understanding of normal signer behavior, compromised keys can go undetected long enough to cause real damage. The practical question is not whether to monitor, but how to build a monitoring system that catches genuine threats without creating alert fatigue that causes actual alerts to be dismissed.

Understanding the multisig attack surface

Safe Wallet’s multisig security model requires that a minimum number of registered signers must approve any asset movement. This threshold—commonly 2-of-3, 3-of-5, or similar configurations—prevents a single compromised key from draining the wallet unilaterally. However, the model assumes that signers remain vigilant and that compromised keys are identified before a sufficient number of approvals accumulate. A signer whose private key has been stolen but remains undetected can approve every transaction the attacker submits. If the threshold is 2-of-3 and one signer’s key is compromised, the attacker needs only one more approval from a legitimate signer who has not yet noticed the pattern of suspicious proposals.

The attack surface therefore has three distinct entry points. First, the signer’s own Web3 wallet—the Ethereum address or hardware wallet that holds the private key used to approve transactions. If this device is compromised through malware, a phishing attack, or a supply-chain breach affecting the hardware, the signer’s approval authority is stolen. Second, the Safe Wallet smart contract itself can be a target, though the contract code has been extensively audited and deployed across multiple chains. Third, the communication channel through which signers receive and review transaction proposals can be compromised, leading signers to approve without understanding what they have authorized.

Monitoring focuses primarily on the first two surfaces because they are directly visible on-chain. Every transaction proposal, confirmation, execution, and reversal is recorded in the Safe Wallet’s contract storage and transaction history. By systematically reviewing this data, a security team can identify patterns that suggest compromise: approvals for unusual recipients, out-of-schedule confirmations, or activity from a signer at times when they are normally unavailable. The third surface—miscommunication or social engineering—requires a separate layer of team coordination and policy discipline that monitoring alone cannot solve.

Setting up baseline activity profiles for each signer

Before alerting on suspicious activity, define what normal activity looks like. This requires collecting historical data on each signer’s typical behavior over a representative period—ideally at least four weeks, longer if the wallet is used infrequently. For each signer, record the timing of their approvals, the types of transactions they typically approve, the geographic location or network from which they usually sign, the devices they use, and the time intervals between proposals and their confirmations.

The goal is to establish a baseline that captures both the expected pattern and natural variation. If a particular signer typically approves transactions within two hours of the proposal, but occasionally requires a day or more due to time zone differences or travel, the baseline should account for that range. If one signer specializes in routine operational transfers while another only reviews emergency actions, their approval profiles will be distinctly different. Grouping all signer activity together and alerting on any deviation is likely to generate false positives and obscure genuine anomalies.

Several data points are worth recording explicitly. The approval latency—how quickly a signer confirms after a proposal is created—can reveal whether a signer is monitoring the wallet continuously or checking at scheduled intervals. The geographic source, inferred from IP address if available or from stated time zones, can indicate whether approvals are arriving from expected locations. The frequency of approvals, measured per day or per week, can highlight sudden changes in signer engagement. The ratio of approvals to rejections can suggest whether a signer is actually reviewing proposals or rubber-stamping every request.

If a signer’s typical latency is 4-24 hours and an approval suddenly appears 30 seconds after a proposal, that is a meaningful anomaly. If a team member travels and their baseline includes occasional out-of-hours approvals from different time zones, a single late-night approval is not suspicious. If a signer has never approved a proposal for a particular type of recipient and one appears, that warrants investigation. The baseline is the foundation for distinguishing signal from noise.

Implementing real-time notifications and alert thresholds

Real-time monitoring requires active watching of Safe Wallet events rather than periodic log reviews. The Safe Wallet contract emits events when transactions are proposed, signed, executed, or reverted. These events can be monitored via blockchain indexers such as Etherscan’s GraphQL API, Alchemy’s Notify service, or purpose-built services that watch specific contract addresses and generate alerts. For comprehensive Web3 security, many organizations combine multiple alert sources to ensure that no notification is lost to service downtime or API delays.

Alert thresholds should be calibrated to the wallet’s activity level and risk tolerance. A vault that processes dozens of transactions per day requires different thresholds than one that manages infrequent large transfers. Key alerts include: (1) any transaction proposal involving an unfamiliar recipient address, especially if the recipient is a newly created contract or an address with minimal on-chain history; (2) approval of a transaction by a signer in less than their typical confirmation window, suggesting possible automation or a compromised key; (3) approval by a signer from a geographic location inconsistent with their historical pattern; (4) a sudden spike in transaction proposals compared to the baseline rate; (5) approval of a transaction denominated in an asset type that the signer does not normally handle; (6) any approval that reaches the execution threshold before the full review period that the organization has documented as standard practice.

A common threshold-setting mistake is to trigger alerts on every unusual event. This creates alert fatigue, a well-documented phenomenon in which the sheer volume of notifications causes recipients to dismiss genuinely dangerous ones. Instead, score alerts by severity. A proposal involving a new recipient might be routine if other aspects of the transaction are normal—the amount is small relative to wallet history, the signer approval timing is standard, and the recipient address has been whitelisted in past transactions. A proposal to move 50% of the vault’s holdings to a completely unknown address should trigger an immediate high-severity alert and possibly a temporary lock on transaction execution.

Distinguishing compromised keys from normal operational variation

Not every deviation from baseline is evidence of compromise. Operational variation is inevitable: signers travel, work irregular hours, take leave, or change roles within their organizations. A signer newly promoted to handle a different asset class will show different approval patterns. A wallet that changes from quarterly transfers to monthly operations will show higher activity. These changes require baseline updates, not immediate security responses.

Genuine compromise indicators tend to cluster. A single unusual approval, in isolation, is ambiguous. A signer who approves a transaction to an unknown address while also approving a second suspicious proposal within hours, when their historical baseline shows one approval every few days, is a stronger signal. A signer whose approvals suddenly appear from a new geographic region at 3 a.m. local time, when they have no history of late-night activity, warrants investigation. The key is pattern matching across multiple dimensions rather than reacting to individual anomalies.

One effective technique is to segment alerts into three categories: confirmed normal, probable normal, and requires investigation. Confirmed normal approvals include transactions from known recipients, approvals with timing consistent with the signer’s baseline, and amounts consistent with the wallet’s operational history. Probable normal includes transactions that deviate in one dimension but align in others—a new recipient, but transferred amount is small and the signer’s timing is standard. Requires investigation includes clusters of anomalies: new recipient, large amount, fast approval, unusual time, geographic inconsistency, or approval of an asset type the signer has never handled before.

Health checks and proactive signer verification

Continuous monitoring of transaction history is reactive—it identifies compromise after the fact. Proactive health checks are designed to verify signer accessibility and key integrity before a crisis. The most straightforward health check is a periodic small test transaction, approved by all signers, sent to an internal address. If a signer fails to approve within their expected window, this can indicate that their key is inaccessible, their Web3 wallet is compromised, or they have lost connection to the Safe Wallet interface. Regular health checks establish a cadence—quarterly or biannually—during which signers are expected to participate in a real transaction approval process.

A second health check is a scheduled meeting in which all signers review the wallet’s activity log, standing list of transaction proposals, and any alerts that have fired since the last review. This should not be a rubber-stamp exercise; it should be a technical discussion in which signers account for approvals they have given, note any transactions they do not remember authorizing, and update their baseline expectations if their circumstances have changed. If a signer cannot account for an approval they gave, or does not remember reviewing the transaction, that is immediate evidence of either key compromise or miscommunication about the wallet’s approval process.

A third proactive measure is periodic signer key verification. If signers use hardware wallets, this might include a PIN or biometric re-entry as part of the health check, ensuring that the device has not been physically replaced or tampered with. If signers use self-custody software wallets, this could involve a verification that the recovery phrase has not been exposed and that the wallet address matches the registered signer address in the Safe Wallet. For institutional setups where signers are Web3 wallets managed by a custodian, health checks should include confirmation that the custodian’s key management practices have not changed and that access controls remain properly configured.

Handling alerts and executing incident response

A well-structured alert should contain enough context for immediate action. Rather than simply notifying that “a new transaction was proposed,” the alert should specify the proposed recipient address and whether it appears in the wallet’s whitelist, the transaction amount and asset, the signer who approved it and whether their timing is anomalous, the transaction purpose if documented in the Safe interface, and the current approval count relative to the execution threshold. A template alert might read: “Signer A approved transfer of 10 ETH to 0x1234… (unknown address, no prior history). Approval at 2:17 AM UTC (unusual for this signer, who typically approves 9-5 EST). This is approval 1 of 3; not yet executable. Recommend immediate review.”

The receiving team should have a documented incident response process. If a single approval is suspicious but not at threshold, the response is investigation and communication: reach out to the signer to confirm they approved the transaction, check whether their Web3 wallet has unusual activity, and review the proposed transaction for legitimacy. If two approvals reach a 2-of-3 threshold and neither can be accounted for, or if both came from signers whose keys are known to be unavailable, immediate escalation is required: pause the wallet if possible, do not allow the transaction to execute, and initiate a key compromise investigation.

Details on best practices for signer monitoring and institutional safety measures are covered in this guide. The core of incident response is speed and evidence preservation. If a compromise is suspected, the priority is preventing execution of any further transactions, not conducting a retrospective investigation. Many Safe Wallet instances are configured to require a time lock before execution—a delay of hours or days between approval and actual fund transfer. This delay is extremely valuable because it creates a window during which monitoring systems can catch suspicious approvals before they become irreversible on-chain actions.

Automating health checks and monitoring with smart contract tools

Manual monitoring is labor-intensive and subject to human error. Several tools have been built to automate signer health checks and transaction monitoring for Safe Wallet. Tenderly offers a transaction simulation and alerting platform that can monitor Safe Wallet contracts, simulate proposed transactions before execution, and alert on abnormal patterns. Forta is a decentralized network of detection bots that can identify suspicious contract interactions and trigger alerts when unusual transactions are proposed. Gelato provides automation services that can execute conditional actions, such as pausing a Safe Wallet if certain anomalies are detected.

A more sophisticated approach is to implement custom monitoring via a bot that periodically queries the Safe Wallet contract state—reading the list of signers, pending transactions, executed transactions, and threshold settings—and comparing this data against stored baselines. The bot can aggregate alerts and send digests to team Slack channels or email addresses, reducing notification noise while ensuring that important patterns are surfaced. For higher-security requirements, a redundant monitoring system with multiple independent data sources ensures that no single service outage will blind the security team.

Automation can also handle routine health checks. A periodic script can submit a small test transaction (e.g., sending 0.01 ETH to an internal burn address) and check whether all signers approve it within a reasonable window. If a signer misses the health check, this can trigger an elevated alert or a manual outreach to confirm the signer’s availability. The test transaction cost is trivial compared to the value of knowing that all signers are actively monitoring the wallet and can respond to legitimate proposals.

Integrating monitoring with operational policies and team culture

The technical monitoring system is only effective if it is integrated with operational discipline. A team that receives comprehensive alerts but lacks a clear process for investigating and acting on them will derive no benefit. Conversely, a team with strong discipline—where signers understand their responsibilities, know the baseline expectations for their own behavior, and have committed to a code of practice—can catch issues that technical monitoring alone might miss.

Effective operational integration includes documented policies on: approval latency expectations, with explicit guidance on when immediate approvals are acceptable versus when thorough review is required; whitelisting procedures for new recipient addresses, requiring that new recipients be evaluated and approved by team consensus before any transfer; communication protocols, defining how signers will inform the team about travel, availability changes, or device upgrades; and escalation paths for suspected compromise, specifying who can trigger a lock on the wallet, who must be notified, and what evidence justifies emergency action.

Team culture also matters significantly. If signers view the monitoring system as surveillance rather than collective protection, they may avoid using the wallet or stop checking alerts. If monitoring generates so many false alarms that signers dismiss all alerts, the system provides no real protection. The most effective teams treat signer monitoring as a shared responsibility: signers actively review their own approvals, alert the team if they notice anything unusual, and view health checks and verification procedures as routine maintenance rather than inconvenience. This requires transparent communication about why monitoring is necessary and regular training on how to interpret alerts and respond appropriately.