A recurring worry for anyone holding assets in a self-custody wallet is being asked to sign something that looks routine but grants a phishing site broader access than intended. No wallet feature removes that risk, and a detection aid is not the same as confirmed protection.
ChainCatcher reported on November 11, 2026, that Bitget Wallet said it will expand AI-assisted threat detection. In the third quarter of 2026, the weekly average number of signature requests flagged as potential phishing rose 7.4 times, from about 5,000 in the second quarter to about 37,000.
Chief operating officer Alvin Kan said the increase may reflect both more threat activity and stronger detection, but the available data cannot show how much each factor contributed. He added that the count covers flagged signature interactions, not separate attack incidents or confirmed losses of funds.
Bitget Wallet introduced AI-assisted risk detection in the second quarter. The expanded checks examine website code and domain-registration details for signs of fraud and simulate a transaction before the user signs, in order to surface hidden permissions. In October, AI identified 90 percent of newly intercepted high-risk domains, compared with 36 percent in the second quarter. Nearly 70 percent of the domains AI flagged that month had no matching alert in the external threat-intelligence sources the team checked.
Phishing aimed at crypto users continued through the period covered by the report. In July 2026, one trader lost nearly $1 million after signing a malicious Ethereum token approval. In August, a Rapid7 investigation found a phishing campaign that targeted 885,000 phone numbers and directed recipients to sites impersonating crypto wallet providers.
One practical check supported by this reporting is to pause before any signature, especially a token approval, and use a pre-sign simulation when the wallet offers one so hidden permissions are visible. Flagged requests and external alerts are aids, not proof of loss or safety, and they do not replace reading what you are about to authorize.
Original report: ChainCatcher, November 11, 2026.
