Bitget Wallet reports expanded AI security checks as phishing detections jump 7.4-fold
A routine-looking wallet prompt can authorize more than you expect. Bitget Wallet says it has expanded checks in its GetShield security engine after average weekly phishing-related detections in Q3 rose to 7.4 times their Q2 2026 level.
- GetShield checks websites, permissions, contracts and signing requests, according to Bitget Wallet.
- Its AI identified 90.2% of newly blocked risky domains during the first four weeks of Q4.
- The figures come from Bitget Wallet’s own systems. The company provided neither underlying totals nor independent validation.
What Bitget Wallet’s numbers show and what they don’t
In an announcement shared with crypto.news on Nov. 11, Bitget Wallet said average weekly phishing-related detections rose 7.4-fold from Q2 to Q3 2026. In other words, the reported weekly average reached 7.4 times its Q2 level. That does not mean phishing across crypto as a whole increased by the same amount.
Phishing-related signing requests made up 57% of detections across four monitored categories in Q3, according to the company. Malicious addresses accounted for 17%, risky contracts 14% and malicious approvals 12%.
Bitget Wallet did not publish the total number of detections behind these figures, define every category in detail or say that an independent party audited the results. The statistics reflect activity flagged by its own systems. They do not show how common phishing was across the wider crypto sector or how much money GetShield prevented users from losing.
The company also said its proprietary AI identified 36.3% of newly blocked risky domains in Q2, 70.2% in Q3 and 90.2% during the first four weeks of Q4. During that early-Q4 period, the AI flagged 69.8% of newly blocked domains without a matching risk alert in either of the two external threat-intelligence databases Bitget checked. The corresponding share in Q3 was 56.3%.
The 90.2% figure is the share of newly blocked risky domains identified by Bitget’s AI. The 69.8% figure is the share identified by the AI that had no matching alert in the two comparison databases. Bitget did not name those databases or explain how it matched alerts, classified risky domains or calculated the comparison. It also did not disclose how many domains were included. These percentages offer a company-reported view of detection coverage, not a full performance audit.
How malicious signatures can put tokens at risk
Bitget Wallet says GetShield screens websites and decentralized applications, analyzes permissions and smart contracts, and checks for unexpected changes to signing requests. The company also says its system simulates transactions to reveal hidden permissions or differences between what a prompt displays and what it would authorize.
Bitget’s announcement describes checks for fraudulent websites, suspicious domains and transaction activity. It does not specify coverage by network or say whether transaction simulation is available for every request. A wallet prompt might ask you to make an ordinary transaction, approve token spending or sign a permit. Each action can grant different powers, so the exact authorization matters.
A token approval can let an application or smart contract move tokens on a user’s behalf. Depending on the permission, it may cover more than one payment. An off-chain permit signature can also authorize token spending, even though signing it does not look like a conventional on-chain transaction.
A reported USDG incident shows the risk. On Oct. 5, crypto.news reported malicious permit signatures linked to Revenue. Security firm Salus said attackers used the signatures to get unlimited spending permission, then moved tokens through the transferFrom function in the same transaction. That function can transfer tokens on a holder’s behalf when the required authorization is in place. The report does not identify a chain or provide further details about what Revenue refers to.
In a case like this, an attacker may not need to steal a user’s private key or seed phrase first. A signature granting the relevant permission may be enough to enable token transfers. That does not make every signature dangerous. It does mean you should understand what a request authorizes before approving it.
Fake wallet websites remain another route in
On Nov. 5, Binance co-founder Changpeng Zhao warned about a fake Trust Wallet website. Researcher Anurag found code on the site that supported Trust Wallet, Phantom and OKX Wallet. It could scan balances and prepare transfers to preset addresses. Signing was disabled when Anurag examined the site.
The example shows how a fake site can target the interaction between a user and a wallet instead of simply asking for a password or seed phrase. A familiar-looking interface does not prove a site is legitimate. Connecting a wallet is not the only moment when a user may face risk. The requested signature or transaction still needs scrutiny.
Bitget Wallet says GetShield works alongside external threat intelligence and token-approval management. The company also lists encrypted private-key storage, multi-party computation, trusted execution environments, biometric authentication, infrastructure isolation, third-party risk assessments and continuous vulnerability monitoring among its protections. It has not provided implementation details for each measure or said which wallet setups use them.
AI can widen the net, but it is not a security guarantee
Bitget Wallet COO Alvin Kan said:
“AI is making cyberattacks cheaper and easier to scale, which means security can no longer rely on known threat lists or a single line of defense.”
Automated analysis may help catch suspicious domains before they appear on known threat lists. But AI systems can miss threats or flag legitimate activity. A high share of AI-identified domains does not show how many attacks were stopped, how many users avoided losses or how often the system raised false alarms.
Bitget Wallet says it plans to expand AI-driven detection and explore AI-assisted incident response with human oversight. Incident response is a future area of exploration, not a capability the company says it has already deployed. Bitget has not given a timeline or explained which actions would require human approval.
Key questions about Bitget Wallet’s security checks
-
Did phishing across crypto rise 7.4-fold?
No. Bitget Wallet reported that its average weekly phishing-related detections in Q3 2026 were 7.4 times the Q2 average. The company did not publish the underlying totals, and the figures do not measure activity across the whole sector.
-
What does the 90.2% AI figure measure?
Bitget Wallet says its AI identified 90.2% of newly blocked risky domains during the first four weeks of Q4. It separately reported that 69.8% of newly blocked domains were flagged by its AI without matching alerts in the two external databases it checked.
-
Can a malicious approval put tokens at risk without a stolen seed phrase?
Yes. If a user signs an authorization that lets a contract move tokens, that permission may enable transfers even if the attacker has not obtained the user’s private key or seed phrase.
-
Does the AI detection share prove GetShield prevents losses?
No. The figures describe Bitget Wallet’s reported detection activity. The company has not provided independent validation, loss-prevention results, false-positive rates or the number of threats the system missed.
-
Is AI-assisted incident response already available?
Bitget Wallet says it plans to explore AI-assisted incident response with human oversight. It has not said when the capability might launch or what it would do.
More checks may catch threats that static lists miss, but signing can never be risk-free. Verify the site, check what a prompt authorizes and be wary of unexpected permissions. With self-custody, protecting your keys is only part of protecting your funds. Bitget Wallet continues to expand its services, but no wallet feature can replace careful signing.
