Pre-transaction screening closes the MPC wallet defense gap

At a glance

What this is: This is Blockaid’s account of how JPEG Trading used real-time transaction screening and asset monitoring to replace manual wallet diligence and support expansion into vault curation.

Why it matters: It matters because wallet, treasury, and DeFi governance teams need controls that operate before signature release and across the full asset inventory, not just after an alert fires.

By the numbers:

• JPEG Trading expanded coverage to 500+ assets across 15+ chains under its monitoring scope.

Context

JPEG Trading’s problem was not generic cyber risk. It was the gap between a fast-moving onchain trading workflow and a control model that still depended on manual review after the fact, even though the firm used MPC signing setups and multi-sigs across 100+ protocols and 15+ chains.

For treasury, prop trading, and vault-operations teams, the key issue is whether transaction safety is enforced at the moment of signature. If the control only notices suspicious activity after execution, it does not protect the workflow that actually creates exposure.

Key questions

Q: How should security teams stop malicious onchain transactions before signature release?

A: They should place transaction simulation and policy checks inside the signing workflow, not beside it. The goal is to validate what the contract will actually do, who it will touch, and whether it fits the wallet’s approved purpose before the signature is released. That shifts control from after-the-fact detection to pre-authorisation governance.

Q: Why do manual wallet reviews fail in fast-moving DeFi operations?

A: Manual review fails because the pace and volume of transactions outstrip human contract-by-contract diligence. Once a team spans many protocols and chains, the control becomes a bottleneck and misses the timing of the actual decision. The result is a governance gap at the moment risk is created, not just a staffing issue.

Q: What signals show that onchain monitoring is not covering the real risk surface?

A: A monitoring programme is incomplete when it only tracks expected holdings but misses vault exposure, protocol dependencies, or chains outside the main ecosystem. If teams cannot see the full asset inventory, they are likely detecting symptoms after market conditions or exploit paths have already shifted. Coverage has to match the operational footprint.

Q: What is the difference between post-trade monitoring and pre-signature screening?

A: Post-trade monitoring looks for risk after a transaction has already happened, while pre-signature screening evaluates the transaction before the wallet authorises it. For onchain treasury and trading teams, that difference matters because the harmful action is often the authorisation itself, not the later observation of it.

Technical breakdown

Why pre-signature screening matters for MPC wallets

MPC signing protects key material, but it does not by itself judge whether a transaction is safe to approve. In this model, the signing workflow can still authorise malicious contract interactions unless the transaction payload is simulated and evaluated before signature release. That is the difference between key custody and transaction assurance. The control point has to sit inside the signing path, not beside it, because the risk is created by what the transaction actually does once broadcast. Practical implication: treat signature-time validation as a control requirement, not a monitoring enhancement.

Practical implication: move transaction risk checks into the approval path before signature release.

How full asset inventory changes onchain monitoring

Onchain monitoring is only useful when it covers the full position set, not just the assets a team already expects to see. JPEG’s case shows why coverage across 30+ chains matters, especially when non-EVM environments and DeFi vaults create visibility gaps that manual tooling misses. Asset inventory is not a static register in this context. It is a live governance surface that must track holdings, vault exposure, and protocol dependencies continuously. Practical implication: monitor the entire position inventory, including chain diversity and vault exposure, as one governed scope.

Practical implication: build monitoring around the complete asset inventory, including non-EVM holdings and vault exposure.

How policy layering separates operational risk from strategy risk

The article shows a useful division between default threat intelligence and desk-specific policy. Default rules handle common malicious patterns, while local policy constrains approved venues, whitelists, and notional limits for specific wallet classes. That pattern matters because risk appetite is not uniform across operational wallets, trading wallets, and vault-collateral workflows. The control model becomes more precise when policy reflects the function of the wallet, not just its existence. Practical implication: define wallet policies by operating purpose, then apply them consistently through the signing layer.

Practical implication: assign wallet policies by use case, then enforce them consistently in the signing layer.

NHI Mgmt Group analysis

Signing-time trust is the real control boundary for onchain wallets: The article shows that custody controls and post-trade monitoring are not enough when the dangerous act is the transaction itself. A wallet programme can be operationally mature and still fail if it cannot evaluate what a transaction does before it is authorised. The practitioner conclusion is that approval authority has to move earlier in the workflow, where the risk is created.

Asset inventory is now a governance problem, not just an observability problem: JPEG’s coverage across 30+ chains and 500+ assets shows why onchain programmes cannot rely on partial visibility. DeFi vaults, non-EVM networks, and protocol-specific exposures expand the governed surface faster than most manual processes can reconcile it. The practitioner conclusion is that inventory quality determines whether monitoring is meaningful or merely reactive.

Wallet purpose must shape policy design: Operational wallets, trading wallets, and vault-management wallets do not deserve the same control posture. JPEG’s layered policy model separates approved venues, address whitelists, and notional limits by workflow, which is the right direction for high-frequency onchain operations. The practitioner conclusion is that governance gets better when policy follows function, not when teams force one rule set across every wallet.

Pre-transaction screening exposes a named concept: signing-path assurance: This article illustrates the need to prove transaction intent at the moment of authorisation, not after the asset has already moved. In NHI terms, the signing path becomes the security control plane for wallet behaviour. The practitioner conclusion is that teams should treat transaction simulation and validation as an identity-governed control surface.

Operational scale changes what ‘manual review’ can mean: Once a firm runs across 100+ protocols, manual contract-by-contract diligence becomes a bottleneck that can no longer keep pace with execution. That does not just create workload pressure; it changes the governance model from review-based to policy-based. The practitioner conclusion is that scale forces transaction governance to become automated if the business is going to keep trading at speed.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: NHI Lifecycle Management Guide

What this signals

Signing-path assurance: Onchain security programmes increasingly need controls that validate transaction intent at the point of authorisation, because after-the-fact monitoring cannot stop a harmful contract interaction from clearing the wallet. For teams running prop trading, treasury, or vault operations, that means the approval path is now part of the identity control plane, not a downstream audit trail.

The practical signal for practitioners is that inventory scope now determines governance quality. If a programme cannot see all assets, vaults, and chain exposures in one place, it cannot reliably set policy, detect drift, or explain its residual risk to the business.

For practitioners

• Enforce transaction simulation before signature Require every wallet workflow to evaluate contract behaviour and destination impact before the signing event can complete.
• Model wallet policy by operating purpose Separate trading, operational, and vault-management wallets into different policy sets so approved venues, address whitelists, and notional limits match the use case.
• Extend monitoring to full asset inventory Track assets, vault exposures, and protocol dependencies across all supported chains, including non-EVM networks, so coverage does not stop at the obvious holdings.
• Replace contract-by-contract review with governed controls Use desk policy and automated screening to handle high-frequency activity, reserving human review for exceptions rather than every transaction.

Key takeaways

• The core risk is not only theft, but unsafe transaction approval through a wallet workflow that trusts too much at signing time.
• Blockaid says JPEG Trading now monitors 500+ assets across 15+ chains, showing how quickly visibility requirements expand once a desk scales.
• Teams should move transaction validation into the signing path and govern wallet policy by use case, not by a one-size-fits-all rule set.

Key terms

• Signing-path assurance: Signing-path assurance is the practice of validating a transaction before the wallet or approval workflow releases authority. It treats the authorisation step itself as a security control, not just the account or key behind it.
• On-Chain Monitoring: On-chain monitoring is the process of observing blockchain transactions and related activity for risk, compliance, or operational signals. In regulated environments, it must be linked to internal records and escalation workflows so teams can investigate activity, not just observe it.
• Transaction Simulation: Transaction simulation is a pre-execution control that evaluates a withdrawal or transfer before it is signed and broadcast. It can expose abnormal routing, risky recipients, or suspicious value movement, giving defenders a chance to block or escalate before funds leave the control boundary.
• Wallet policy layering: Wallet policy layering is the separation of different rules for different wallet purposes, such as trading, operations, or vault management. It helps teams align privileges, limits, and venue approvals with the function each wallet actually performs.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.