A self-custody wallet usually puts the holder in front of one repeated choice: whether to sign what a site is asking. A token approval can look routine and still grant a permission that is easy to miss. In a report published on November 11, 2026, at 18:16 (UTC+8), ChainCatcher said wallet provider Bitget Wallet would expand AI-assisted threat detection after a sharp rise in signature requests it flagged as possible phishing.
In the third quarter of 2026, Bitget Wallet’s weekly average of signature requests flagged as potential phishing grew 7.4 times, from about 5,000 in the second quarter to about 37,000. Chief operating officer Alvin Kan said the increase may reflect both more threat activity and better detection. He said the available data cannot show how much each factor contributed.
Kan also said the statistic counts flagged signature interactions. It is not a count of separate attacks, and it is not a tally of confirmed fund losses. A larger flag total can mean more requests are being marked, that more risky requests are appearing, or both. The 7.4-fold change should not be read as money already stolen.
Bitget Wallet introduced AI-assisted risk detection in the second quarter of 2026. The expanded checks analyze website code and domain-registration information for signs of fraud, and they simulate the transaction before the user signs in order to surface hidden permissions. Of high-risk domains newly blocked in October, 90 percent were identified by AI, compared with 36 percent in the second quarter. Nearly 70 percent of the domains AI flagged that month had no matching alert in the external threat-intelligence sources Bitget Wallet checked.
The same report said phishing against crypto users had continued, and it kept those cases separate from the flagged-signature totals. It reported that in July 2026 a trader lost nearly $1 million after signing a malicious Ethereum token approval. It also reported that an August 2026 Rapid7 investigation found a phishing campaign aimed at 885,000 phone numbers, directing recipients to sites impersonating crypto wallet providers. The July figure is given as nearly $1 million, not an exact sum, and the report does not say either case is included in the about 5,000 or about 37,000 weekly averages.
The practical point for a holder is the signature itself. The checks Bitget Wallet described look at the site, the domain record, and a simulated transaction before approval, because the on-screen request may not show every permission being granted. A domain absent from the external sources Bitget Wallet checked could still be flagged. Those steps can make a hidden permission easier to notice. They do not mean a wallet, an AI check, or a threat list removes the risk of approving the wrong request.
Original report: ChainCatcher, November 11, 2026