Bitget Wallet has expanded its AI-powered threat detection after average weekly phishing-related detections rose 7.4-fold between the second and third quarters of 2026.
Summary
- Phishing-related signing risks accounted for 57% of detections across four monitored categories in Q3.
- AI helped identify 90% of newly blocked risky domains in October, the wallet said.
- Nearly 70% of newly blocked domains lacked matching alerts in two external databases checked.
- GetShield combines website screening, permission analysis and signing checks before users authorize transactions.
In a Nov. 11 announcement shared with crypto.news, Bitget Wallet said that the expansion covers fraudulent websites, suspicious domains and transaction activity, including requests that can give attackers access to assets without exposing users’ private keys.
The self-custodial wallet has integrated the capabilities into GetShield, its security engine, to examine risks before users approve potentially harmful activity.
Bitget Wallet reports more threats outside existing databases
In its official security update, the company provided more precise figures for AI’s role in identifying newly blocked risky domains: 36.3% in Q2, 70.2% in Q3 and 90.2% during the first four weeks of Q4.
Across the same early-Q4 period, 69.8% of newly blocked risky domains were flagged by its proprietary AI without matching risk alerts in the two external threat intelligence databases used for comparison. The corresponding share was 56.3% in Q3.
The company described the findings as additional detection coverage beyond existing threat lists. Its announcement rounded the October figures to 90% and nearly 70%, respectively.
Within the wallet’s Q3 monitoring, phishing-related signing requests represented 57% of detections. Malicious addresses accounted for 17%, risky contracts for 14% and malicious approvals for 12%, using the announcement’s rounded figures.
The figures describe detections within the company’s security systems, with the 7.4-fold comparison based on weekly averages across the two quarters.
GetShield checks websites and permissions before signing
The expanded analysis examines website code for signs of fraud or impersonation. Domain checks consider registration details and connections with known malicious domains to identify emerging threats.
For transaction activity, the wallet said it simulates outcomes to uncover hidden permissions or differences between what a request displays and what it would actually authorize.
GetShield’s checks cover websites and decentralized applications, permissions and smart contracts, and unexpected changes to signing requests. The company pairs those checks with external threat intelligence and token approval management.
“AI is making cyberattacks cheaper and easier to scale, which means security can no longer rely on known threat lists or a single line of defense,” said Alvin Kan, Bitget Wallet’s chief operating officer.
Kan said protection needs to cover the entire system as self-custodial wallets move beyond trading into payments and everyday finance. He described the company’s focus as identifying risks earlier and containing failures while preserving users’ control.
Recent phishing cases target wallet authorizations
On Oct. 5, crypto.news reported on malicious USDG permit signatures linked to Revenue. Security firm Salus said attackers used the signatures to obtain unlimited spending permission, then moved tokens through the transferFrom function within the same transaction.
The permissions allowed funds to move without attackers first obtaining the holder’s private key or seed phrase, according to the findings.
A separate fake Trust Wallet website drew a warning from Binance co-founder Changpeng Zhao on Nov. 5. Researcher Anurag identified code supporting Trust Wallet, Phantom and OKX Wallet that could scan balances and prepare transfers to preset addresses. Signing was disabled when he examined the site.
In earlier comments on self-custody, published Oct. 6, Kan said wallets should explain whether an approval authorizes one payment or permits an application to move funds later. He called for simple ways to revoke existing permissions.
Security plans include incident response under human oversight
Beyond detection, the wallet lists encrypted private-key storage, multi-party computation, trusted execution environments, biometric authentication and infrastructure isolation among its protections. Third-party risk assessments and continuous vulnerability monitoring form part of that framework.
Bitget Wallet plans to expand AI-driven detection further and explore AI-assisted incident response under human oversight.
In the United States, the FBI’s cryptocurrency guidance encourages scam reports even when no money has been lost. The bureau warns against cryptocurrency recovery services that demand an upfront fee. It asks victims to document how contact began and which platforms they used to communicate with the suspected scammer.
Its Internet Crime Complaint Center asks complainants to preserve wallet addresses, transaction hashes, amounts, dates, and details of any web domains involved.
