Bitget Wallet Phishing Alerts Climb Sevenfold to 37,000 a Week

On November 11, Bitget Wallet revealed that it is broadening its AI-driven threat detection capabilities after weekly phishing alerts surged to an average of roughly 37,000 signing requests during the third quarter of 2026. This figure marks a 7.4-fold increase compared to the second quarter’s weekly average of 5,000. The firm clarified that the rise is partly a result of enhanced monitoring rather than solely increased malicious activity, noting that the data tallies flagged signing interactions instead of distinct attacks or verified monetary losses.

Bitget Wallet Phishing Alerts and What Drives the Jump

Alvin Kan, the chief operating officer, discussed the data with Cointelegraph, explaining that the sharp rise likely stems from both heightened threat levels and sharper oversight. Because the wallet initially introduced AI-powered risk detection during the second quarter, the expansion unveiled this month builds upon a framework that has been operational for under two full quarters.

Out of all Q3 detections, phishing-related signing requests accounted for the largest share at 57%. This was followed by malicious addresses at 17%, risky contracts at 14%, and malicious approvals at 12%.

How GetShield Checks Sites and Permissions Before Users Sign

The November 11 disclosure outlines enhanced safeguards integrated into GetShield, the security engine powering Bitget Wallet. The system examines website code to spot fraud or impersonation attempts, and subsequently inspects domain registration records alongside connections to known hazardous domains.

Regarding transactions, GetShield runs simulations of potential outcomes prior to user approval, searching for concealed permissions or disparities between the interface display and the actual privileges granted by the signature. This precaution is vital because a cleverly designed approval can grant attackers access to user funds without ever compromising private keys. The system combines external threat intelligence with its own screening layers, managing token approvals across websites, smart contracts, and decentralized applications, which includes identifying sudden, last-minute alterations to signing requests.

AI Flags 90% of Newly Blocked Risky Domains

During October, artificial intelligence successfully flagged 90% of newly blocked risky domains, marking an increase from 36% in Q2. Approximately 70% of those identified domains lacked any matching entries within external threat feeds consulted by the wallet. Such blind spots — representing actual gaps in existing blacklists rather than hypothetical concerns — motivate Bitget Wallet to look beyond standard third-party databases.

Kan described the overarching objective as identifying threats sooner and minimizing potential damage while ensuring users retain absolute control as self-custodial wallets expand into everyday financial services and payments.

Why Signing Permissions Are the Core Risk

The dangers are very real. In July, a single trader suffered a loss approaching $1 million after authorizing a malicious Ethereum token approval. This incident demonstrated how an individual signature, rather than a stolen seed phrase, can empty a crypto wallet.

In statements made on October 6 and covered by crypto.news, Kan asserted that wallets must clearly indicate whether a given approval pertains to a single transaction or permits an application to continuously access funds, while also making the revocation of existing permissions straightforward. The next steps outlined by Bitget Wallet involve broader AI threat detection paired with AI-assisted incident response, all while keeping human supervisors involved.

FAQ

When did Bitget Wallet introduce AI-assisted risk detection?

The initial introduction came in Q2 2026, according to chief operating officer Alvin Kan. The Nov. 11 announcement expands that work across website, domain and transaction analysis.

What share of Q3 detections involved phishing-related signing requests?

These requests made up 57% of the wallet’s detections across four monitored categories. The remaining categories were malicious addresses, risky contracts and malicious approvals.

How does GetShield check what a transaction would authorize?

GetShield simulates transaction outcomes before approval. It looks for concealed permissions and discrepancies between the displayed signing request and the actions it would permit.

How can malicious signing permissions expose funds without revealing a private key?

A signature can authorize an application to spend tokens, giving an attacker a route to funds without obtaining the key. In his Oct. 6 comments, Kan emphasized the distinction between approving a single payment and granting ongoing spending permission.

What further security work does Bitget Wallet plan?

The company plans to explore AI-assisted incident response alongside further expansion of threat detection. It says that response work would aim to identify emerging risks and accelerate action under human oversight.

This article is for information only and is not financial advice.