Key facts
- Bitget Wallet flagged about 37,000 signing requests a week for potential phishing in Q3 2026, up from 5,000 in Q2, per Alvin Kan.
- Kan said the tally counts flagged signing interactions, not unique attacks or confirmed financial losses.
- Bitget Wallet said AI identified 90% of newly blocked risky domains in October, against 36% in Q2.
- Nearly 70% of domains its AI flagged in October had no matching alerts in the external threat feeds it checked, Bitget Wallet said.
- Bitget Wallet said its expanded checks examine website code and domain registration details and simulate transactions before users sign.
Bitget Wallet said on November 11, 2026, that its weekly average of signing requests flagged for potential phishing rose 7.4-fold in the third quarter of 2026, to about 37,000 from 5,000 in the second quarter. The figures came from chief operating officer Alvin Kan, who told Cointelegraph that the increase likely reflected both greater threat activity and improved detection.
"The increase likely reflects both greater threat activity and improved detection capabilities, although the data does not allow us to quantify each factor's contribution," Kan said. He added that the tally counted flagged signing interactions, not unique attacks or confirmed financial losses.
Bitget Wallet introduced AI-assisted risk detection in the second quarter, Kan said. The wallet said its expanded checks examine website code and domain registration details for signs of fraud, and simulate transactions to spot hidden permissions before a user signs.
Bitget Wallet also said AI helped identify 90% of newly blocked risky domains in October, compared with 36% in the second quarter. Nearly 70% of domains its AI flagged that month had no matching alerts in the external threat feeds it checked, the company said.
The report cited other phishing incidents: in July, a trader lost nearly $1 million after signing a malicious Ethereum token approval, and an August investigation by Rapid7 described a phishing campaign that targeted 885,000 phone numbers and directed recipients to websites impersonating crypto wallet providers.