Bitget Wallet says it is rolling out a broader AI-assisted system for detecting phishing attempts, citing a sharp rise in the number of signing requests it flags as potentially fraudulent. The wallet reported that its weekly average of suspicious signing interactions increased by 7.4 times in the third quarter of 2026, a change it attributes to both a possible rise in threat activity and improvements in its own detection.

In Q3 2026, Bitget Wallet flagged roughly 37,000 potentially phishing-related signing requests per week, compared with about 5,000 per week in Q2, according to Alvin Kan, the wallet provider’s chief operating officer. Kan said the figures reflect flagged signing interactions rather than unique attacks or confirmed financial losses.

Key takeaways

Bitget Wallet’s flagged suspicious signing requests rose to about 37,000 per week in Q3 2026 from around 5,000 per week in Q2.
The company links the jump to a combination of more threat activity and better detection, but said it cannot separate the impact of each.
Its AI checks include reviewing website code and domain registration details, plus simulating transactions to surface hidden permissions before users sign.
Bitget Wallet said AI identified 90% of newly blocked risky domains in October, up from 36% in Q2.

Why suspicious signing requests matter

Phishing attacks in crypto frequently pivot on approvals and signatures—users are tricked into authorizing token transfers, granting permissions, or signing messages that malicious contracts can later exploit. Bitget Wallet’s new emphasis is therefore aimed at the moment users interact with a wallet during a signing flow.

Kan noted that the wallet’s counted events are “flagged signing interactions,” not a measure of how many distinct attacks were carried out or how many resulted in confirmed losses. That distinction is important for readers: an increase in flagged requests can indicate both more attackers and stricter or more accurate detection, without necessarily proving that more users were actually harmed.

What Bitget Wallet says its AI is doing differently

Bitget Wallet introduced AI-assisted risk detection in Q2 2026, and says its ongoing expansion focuses on identifying fraudulent web properties and risky transaction permissions before a signature is completed.

According to the wallet provider, its AI-assisted checks examine:

Website code and domain registration details for indicators of fraud.
Transaction simulations to identify “hidden permissions” that may not be obvious during the signing prompt.

Rather than relying solely on lists of known malicious domains, Bitget Wallet’s approach attempts to spot suspicious characteristics and predict behavior tied to a user’s signing flow. Kan also emphasized the limitations of the metric: the data does not quantify how much of the Q3 jump came from attackers versus detection improvements.

Performance signals from October’s domain blocking

Bitget Wallet also provided internal performance figures related to its domain-risk tooling. The company said AI helped identify 90% of “newly blocked risky domains” in October, compared with 36% in Q2.

The wallet added that nearly 70% of the domains flagged by its AI in October did not show matching alerts in the external threat feeds it checked. That gap suggests Bitget Wallet’s system may be catching patterns not reflected in other datasets, or it may be applying broader heuristics that external providers have not yet tagged.

For users and security-minded investors, this is a meaningful nuance: detection systems that surface leads beyond traditional feeds can reduce time-to-mitigation, but they also raise questions about false positives and operational burden. Bitget Wallet did not provide rates of confirmed maliciousness versus incorrect flags in the information shared, so readers should treat the performance claims as directional rather than definitive.

Rising urgency amid ongoing phishing campaigns

Bitget Wallet’s update lands in the context of persistent phishing threats targeting crypto users. Earlier this year, a trader reportedly lost nearly $1 million after signing a malicious Ethereum token approval. In a separate investigation, Rapid7 reported a campaign that targeted 885,000 phone numbers and directed recipients to websites impersonating crypto wallet providers.

These examples reflect a common pattern: attackers lure users to fake interfaces or deceptive approval prompts, then rely on users to sign transactions without fully understanding what permissions are being granted. By focusing on the signing stage, Bitget Wallet is positioning its defenses to address an especially high-risk moment in the user journey.

While Bitget Wallet’s announcement does not claim that phishing losses are rising at the same rate as flagged requests, the company’s reported increase in suspicious signing interactions suggests that attackers may be more active—or that more users are encountering suspicious flows that are now being detected more reliably.

What to watch next

As Bitget Wallet expands its AI checks, the key question for users will be how quickly the system can keep up with evolving phishing infrastructure—and whether future reporting breaks out confirmed malicious outcomes from mere flagged interactions. Investors and builders in wallet security should also watch for whether Bitget Wallet continues improving coverage of newly risky domains without over-relying on external threat feeds.