Bitget Wallet reports 7.4-fold rise in phishing signing alerts, expands AI checks

What happened

Bitget Wallet said on Wednesday that it is broadening AI-assisted threat detection after the average number of signing requests it flags for potential phishing each week rose 7.4-fold between the second and third quarters of 2026. The self-custodial wallet provider put the Q3 figure at roughly 37,000 flagged signing requests per week, against about 5,000 in the previous quarter, according to chief operating officer Alvin Kan. Cointelegraph and Crypto.news both carried the announcement.

Kan described the increase as probably driven by a combination of heavier threat activity and stronger detection, while cautioning that the data does not let the company measure how much each factor contributed. Bitget Wallet began deploying AI-assisted risk detection in Q2, he added.

The company said the tally covers flagged signing interactions rather than distinct attacks or confirmed financial losses. The checks sit inside GetShield, its security engine, which screens websites and decentralized applications, examines permissions and smart contracts, and looks for unexpected alterations to signing requests before a user approves them.

Under the expanded setup, the wallet inspects website code for signs of fraud or impersonation, reviews domain registration details and ties to known malicious domains, and simulates transactions to expose hidden permissions or differences between what a request displays and what it would actually authorize.

Why it matters

The focus is on approvals rather than private keys. Several recent incidents described in the reports show how a single signature can open the door to funds without a seed phrase ever being exposed, which is why the wallet is concentrating on what a user is asked to authorize before they sign.

Kan argued that attackers are scaling up more cheaply with AI, and that security built only around known threat lists or one layer of defence is no longer sufficient. He said protection needs to span the whole system as self-custodial wallets take on payments and everyday finance, with the aim of catching risks earlier while users keep control of their assets.

The disclosure also illustrates a measurement problem for wallet security teams: rising detection counts can mean more attacks, better tooling, or both, and publishing such figures without splitting the causes leaves the underlying trend partly ambiguous.

What the data shows

Within Q3 monitoring, phishing-related signing risks made up 57% of detections across four tracked categories. Malicious addresses accounted for 17%, risky contracts for 14% and malicious approvals for 12%, based on the rounded figures in the announcement.

Bitget Wallet gave more granular numbers for AI's role in identifying newly blocked risky domains: 36.3% in Q2, 70.2% in Q3 and 90.2% during the first four weeks of Q4. Over the same early-Q4 window, 69.8% of newly blocked risky domains were flagged by the company's own AI without a matching alert in the two external threat intelligence databases used for comparison; the equivalent share was 56.3% in Q3. The announcement rounded the October figures to 90% and nearly 70%.

The company presented those results as extra coverage beyond existing threat lists, while noting that all the figures describe detections inside its own security systems.

Background

Phishing against crypto users has continued through the year. Cointelegraph noted that in July a trader lost close to $1 million after signing a malicious Ethereum token approval, and that an August Rapid7 investigation found a campaign aimed at 885,000 phone numbers that sent recipients to sites impersonating wallet providers.

Crypto.news reported on Oct. 5 that security firm Salus had linked malicious USDG permit signatures to Revenue, with attackers using them to obtain unlimited spending permission and moving tokens through transferFrom in the same transaction. On Nov. 5, Binance co-founder Changpeng Zhao warned about a fake Trust Wallet website, and researcher Anurag identified code tied to Trust Wallet, Phantom and OKX Wallet that could scan balances and prepare transfers to preset addresses, though signing was disabled when he inspected the site.

Beyond detection, Bitget Wallet lists encrypted private-key storage, multi-party computation, trusted execution environments, biometric authentication and infrastructure isolation among its safeguards, alongside third-party risk assessments and continuous vulnerability monitoring.

What to watch

Bitget Wallet said it intends to push AI-driven detection further and to explore AI-assisted incident response operating under human oversight. How quickly those tools ship, and whether flagged volumes keep climbing, are open questions the reports do not answer.

The reports also point to guidance rather than enforcement. The FBI's cryptocurrency guidance encourages victims to report scams even when no funds are lost, warns against recovery services that demand upfront fees, and asks complainants to preserve wallet addresses, transaction hashes, amounts, dates and details of any web domains involved.

Questions readers ask