Bitget Wallet Expands AI Threat Detection as Phishing Detections Jump 7.4-Fold

Bitget Wallet expanded its AI-powered threat detection after average weekly phishing-related detections rose 7.4-fold between the second and third quarters of 2026, according to a Nov. 11 announcement shared with crypto.news.

The self-custodial wallet provider integrated the expanded capabilities into GetShield, its security engine, to examine risks across fraudulent websites, suspicious domains and transaction activity before users approve potentially harmful actions. That includes signing requests that can give attackers access to assets without ever exposing a user's private keys.

How much of the detection is AI doing?

The company's security update breaks AI's contribution into precise quarterly figures. AI identified 36.3% of newly blocked risky domains in Q2, 70.2% in Q3, and 90.2% during the first four weeks of Q4. The announcement rounded the October figure to 90%.

The more striking number is what those catches represent. Across the early-Q4 period, 69.8% of newly blocked risky domains were flagged by Bitget Wallet's proprietary AI without any matching risk alert in the two external threat intelligence databases the company uses for comparison. The corresponding share was 56.3% in Q3. Bitget Wallet rounded that to "nearly 70%" in its announcement and described the findings as additional detection coverage beyond existing threat lists.

Within the wallet's Q3 monitoring across four categories, phishing-related signing requests accounted for 57% of detections. Malicious addresses represented 17%, risky contracts 14% and malicious approvals 12%, per the announcement's rounded figures. The 7.4-fold phishing comparison is based on weekly averages across the two quarters and reflects detections within the company's own security systems.

What does GetShield actually check?

The expanded analysis screens website code for signs of fraud or impersonation. Domain checks weigh registration details and connections to known malicious domains to surface emerging threats.

For transaction activity, the wallet simulates outcomes before a user signs, aiming to uncover hidden permissions or gaps between what a request displays and what it would actually authorize. GetShield's checks span websites and decentralized applications, permissions and smart contracts, and unexpected changes to signing requests. The company pairs those checks with external threat intelligence and token approval management.

"AI is making cyberattacks cheaper and easier to scale, which means security can no longer rely on known threat lists or a single line of defense," said Alvin Kan, Bitget Wallet's chief operating officer.

Kan said protection needs to cover the entire system as self-custodial wallets move beyond trading into payments and everyday finance. He framed the company's focus as identifying risks earlier and containing failures while preserving users' control of their assets.

Why signing-request phishing is the pressure point

Two recent incidents illustrate the attack surface GetShield is built against. On Oct. 5, crypto.news reported on malicious USDG permit signatures linked to Revenue. Security firm Salus found that attackers used the signatures to obtain unlimited spending permission, then moved tokens through the transferFrom function within the same transaction. The scheme worked without the attacker ever obtaining the holder's private key or seed phrase.

On Nov. 5, Binance co-founder Changpeng Zhao publicly warned about a fake Trust Wallet website. Researcher Anurag identified code supporting Trust Wallet, Phantom and OKX Wallet that could scan balances and prepare transfers to preset addresses. Signing was disabled at the time he examined the site.

Kan had already flagged the underlying design problem. In comments published Oct. 6, he said wallets should make clear whether an approval authorizes a single payment or lets an application move funds later, and he called for simple ways to revoke existing permissions.

What sits underneath the AI layer?

Beyond detection, Bitget Wallet lists a set of baseline protections: encrypted private-key storage, multi-party computation, trusted execution environments, biometric authentication and infrastructure isolation. Third-party risk assessments and continuous vulnerability monitoring form part of that framework.

On the roadmap, the company plans to expand AI-driven detection further and to explore AI-assisted incident response under human oversight — a hedge against letting automated systems act unilaterally on user funds.

For users who do get hit, the FBI's cryptocurrency guidance in the United States encourages scam reports even when no money has been lost. The bureau warns against cryptocurrency recovery services that demand an upfront fee and asks victims to document how contact began and which platforms they used to communicate with the suspected scammer. Its Internet Crime Complaint Center requests that complainants preserve wallet addresses, transaction hashes, amounts, dates and details of any web domains involved.

With AI-flagged domains now representing the large majority of Bitget Wallet's new blocks — and with most of them absent from external threat databases — the burden of first-line detection is shifting from shared industry blocklists to proprietary, in-wallet screening, a structure likely to spread across the self-custody sector as AI-scaled attacks get cheaper.