Bitget Wallet's Weekly Phishing Flags Rose 7.4-Fold to 37,000 in Q3

Bitget Wallet Expands AI Threat Detection

Bitget Wallet said on Nov. 10 that it is widening AI-assisted threat detection after the signing requests it flagged for phishing risk rose 7.4-fold quarter over quarter. The wallet's weekly average of flagged requests reached about 37,000 in Q3 2026, up from roughly 5,000 in Q2, figures the company's chief operating officer, Alvin Kan, provided in an interview. A signing request is the step where a wallet user approves a transaction or grants a token permission, which makes it the point where most wallet fraud executes. Kan cautioned that the tally counts flagged interactions, not confirmed attacks or realized losses, and said the jump probably combines a real rise in attacker activity with better detection, adding that the data cannot separate the two effects. Bitget Wallet rolled out AI-assisted risk detection in Q2, so part of the increase may simply reflect sharper screening.

Of the four risk categories the wallet monitors, phishing-related signing risk accounted for 57.4% of flagged interactions in Q3. Malicious addresses made up 16.5%, risky contracts 14.2% and malicious approvals 11.8%; these shares describe the wallet's monitored universe, not industry-wide loss rates. AI involvement in identifying newly blocked risky domains climbed from 36.3% in Q2 to 70.2% in Q3 and 90.2% in the first four weeks of Q4. In that Q4 window, 69.8% of the domains its AI flagged had no matching alert in either of the two external threat-intelligence databases the company cross-references. The expanded checks read website code and domain registration details for fraud patterns and simulate transactions to surface hidden permissions before a user signs. Bitget Wallet plans to extend AI-based detection further and is weighing AI-assisted incident response under human oversight.

A $1 Million Approval and 885,000 Numbers

The alert data lands against an active fraud backdrop. In July, a trader lost close to $1 million after signing a malicious Ethereum token approval, an operation that hands an attacker standing permission to move tokens out of the affected wallet until the grant is revoked. Security firm Rapid7 documented a separate phishing campaign in August built around 885,000 phone numbers, which steered recipients toward websites impersonating crypto wallet providers. The same infrastructure carried account-verification tools, phishing panels and counterfeit wallet applications, and Rapid7 reported tooling that matched those numbers against crypto exchange accounts to narrow down targets. The firm noted that the record count does not equal the number of people actually contacted or defrauded.

Researchers have also documented abuse of the pre-transaction checks wallets use to protect signers. A study covering August 2024 through June 2025 identified 4,224 phishing contracts and 5,742 victim addresses that reversed wallet transaction-preview features against their users. That study measures contracts and addresses, so its totals are not directly comparable with Bitget Wallet's signing-alert count, which tracks flagged requests rather than confirmed victims. The gap between the two methodologies matters when reading Q3 numbers: a rising alert tally can mean more attacks, broader coverage, or both. The campaign details also show how industrialized wallet phishing has become, with phone lists, verification tooling and fake apps assembled into repeatable kits rather than one-off lures. Anyone holding funds on an exchange account rather than a self-custody wallet faces a different risk profile, and our Crypto Exchange vs Crypto Wallet comparison sets out where custody responsibility shifts between the two.

AI Screening Ahead of Threat Feeds

Taken together, the two releases describe a detection race rather than a clean measure of criminal volume. The most informative number for defenders is the 69.8% of AI-flagged domains absent from external threat feeds in early Q4: it indicates model-based screening is catching infrastructure before shared blocklists do, which is precisely the gap novel phishing exploits. Kan's own caveat stands, though; flagged requests are not losses, and the 7.4-fold rise cannot be read as a 7.4-fold rise in successful attacks. The practical defense is unchanged. Because one signed approval can drain a connected account, self-custody setups that keep the private key offline, from a cold wallet to an HD wallet with segmented accounts or a Tangem mobile wallet, limit what a single mistake can reach.