Have you ever hovered over a transaction approval and felt that small knot in your stomach? That quiet voice asking whether the screen is really showing what you think it is. In the third quarter of 2026 that feeling became far more common for crypto users. One major self-custodial wallet recorded a 7.4-fold jump in average weekly phishing-related detections between the second and third quarters. The numbers are not abstract. They reflect real attempts to drain assets without ever stealing a seed phrase.
I have followed wallet security developments for years, and this particular surge stands out. It is not just more noise. It is a clear shift in how attackers operate. They no longer need to trick someone into revealing private keys. Instead they craft clever signing requests, malicious approvals, and look-alike domains that can empty an account in a single confirmation. Bitget Wallet responded by expanding the AI capabilities inside its GetShield security engine. The results they shared deserve a closer look because they reveal both the scale of the problem and a practical way forward.
Understanding The Sharp Rise In Phishing Detections
The headline figure is simple to grasp yet hard to ignore. Average weekly phishing-related detections climbed 7.4 times from the second quarter to the third. That kind of growth does not happen by accident. Attackers have discovered that artificial intelligence lowers the cost of launching large campaigns. They can generate convincing websites, craft personalized messages, and test new domain names at a pace that older detection methods struggle to match.
Inside the wallet’s own monitoring systems, phishing-related signing risks made up 57 percent of all detections in the third quarter. Malicious addresses accounted for 17 percent, risky contracts for 14 percent, and malicious approvals for the remaining 12 percent. These percentages matter because they show where the real danger sits. Most of the risk appears at the moment a user is asked to sign something. The interface may look routine. The underlying permission may be anything but.
What I find especially telling is the performance of the AI itself. In the second quarter the system identified 36.3 percent of newly blocked risky domains. By the third quarter that share had climbed to 70.2 percent. In the first four weeks of the fourth quarter the figure reached 90.2 percent. Even more striking, nearly 70 percent of those newly blocked domains in early Q4 had no matching alerts in the two external threat intelligence databases the team used for comparison. The AI was catching threats that traditional lists simply did not know about yet.
Why Traditional Blacklists Fall Short
For a long time the industry relied on shared lists of known bad domains and addresses. That approach worked reasonably well when attackers moved slowly. Today the situation is different. A new phishing site can appear, collect signatures for a few hours, and disappear before most databases update. By the time the domain lands on a public list, the damage is often already done.
Bitget Wallet’s data shows that its proprietary AI filled exactly that gap. Almost seven out of ten newly blocked domains in the early fourth quarter period were unique to its system. That is not a small improvement. It is the difference between reacting after the fact and stopping an attack before a user ever sees the malicious request.
In my experience, users often assume that if a site looks professional and the wallet interface does not flash a red warning, everything is fine. That assumption is becoming dangerous. Attackers now invest real effort into visual fidelity. They copy logos, fonts, and even the exact wording of legitimate dApps. The only reliable defense is automated analysis that looks deeper than the surface.
How GetShield Actually Works
GetShield is the name Bitget Wallet gives to its integrated security engine. The expanded version examines three main layers before a user can approve a transaction.
- Website and domain screening that inspects code for signs of fraud or impersonation and checks registration details against known malicious patterns
- Permission and smart-contract analysis that simulates the actual outcome of a signing request
- Real-time comparison of what the interface displays versus what the transaction would actually authorize
The simulation step is particularly important. Many modern phishing attacks rely on the gap between what a user believes they are approving and what the smart contract will actually execute. An unlimited token approval, for example, can look like a simple confirmation. Once granted, the attacker can drain the entire balance at any later moment without further interaction.
I have always believed that the best security tools are the ones that stay almost invisible until they are needed. GetShield aims for that balance. It runs checks in the background, pairs its findings with external intelligence feeds, and only interrupts the user when something genuinely suspicious appears. That design respects the self-custodial principle while still offering meaningful protection.
Recent Real-World Attacks That Highlight The Risk
Even without naming specific platforms, the pattern of recent incidents is clear. Attackers have begun targeting permit signatures that grant unlimited spending rights. Once a user signs, the attacker can move tokens through a transfer function in the same transaction. No private key is required. The permission itself becomes the vulnerability.
In another common approach, carefully crafted websites mimic popular wallets and ask visitors to connect. The page may scan balances and prepare transfers to preset addresses. Sometimes the actual signing step is disabled during research, yet the intent is obvious. These sites often support multiple popular wallet interfaces at once, increasing their reach.
These cases underline a simple truth. The private key or seed phrase is no longer the only high-value target. The moment of authorization has become the new battleground. Any wallet that does not carefully inspect what a user is about to sign is leaving a wide opening.
The Broader Context Of AI In Cyber Attacks
One of the more thoughtful comments from the wallet’s leadership captured the larger picture. Artificial intelligence is making cyberattacks cheaper and easier to scale. Security teams can no longer rely on known threat lists or a single line of defense. Protection must cover the entire system, especially as self-custodial wallets move beyond simple trading into payments and everyday financial activity.
That observation feels accurate. Generative tools allow attackers to produce convincing copy, generate new domains in bulk, and even adapt their tactics based on which approaches succeed. Defenders need the same speed and adaptability. Purely reactive systems will always lag. Proactive, AI-driven analysis that examines behavior rather than just known signatures is becoming essential.
At the same time, the human element remains critical. Technology can flag risk, yet users still decide whether to proceed. Clear explanations of what an approval actually means, simple ways to revoke permissions, and transparent warnings all help close the remaining gap.
Practical Steps Every User Can Take Right Now
Even the best automated protection works better when paired with good habits. Here are practices that consistently reduce exposure.
- Pause before every signature. Read the full permission request rather than relying on the summary text.
- Prefer limited approvals over unlimited ones whenever a dApp offers the choice.
- Regularly review and revoke old token approvals that are no longer needed.
- Treat unexpected domain names or slight variations in branding as immediate red flags.
- Keep a small amount of funds in a daily-use wallet and store larger holdings offline or in a more restricted setup.
None of these steps is complicated. Together they create layers that make opportunistic attacks far less profitable. I have found that the users who treat every signing request with a brief moment of skepticism rarely fall victim to the most common scams.
Looking Ahead: AI-Assisted Response Under Human Oversight
Bitget Wallet has indicated plans to push AI detection even further and to explore AI-assisted incident response. The key phrase is “under human oversight.” That balance feels right. Automation can handle the volume and speed that modern attacks require. Humans remain essential for judgment, edge cases, and continuous improvement of the models.
Additional protections already in place include encrypted private-key storage, multi-party computation, trusted execution environments, biometric authentication, and infrastructure isolation. Regular third-party risk assessments and continuous vulnerability monitoring complete the framework. No single measure is perfect. The combination creates meaningful resilience.
Perhaps the most interesting aspect is how these developments change the relationship between users and their wallets. Self-custody has always meant personal responsibility. Better tools do not remove that responsibility. They simply make it more manageable. A wallet that can explain whether an approval authorizes a single payment or opens a long-term spending channel is far more useful than one that simply presents a yes-or-no button.
Why This Matters Beyond One Wallet
The 7.4-fold increase is not unique to a single product. It reflects a broader industry trend. As more people move assets into self-custodial solutions, the incentive for attackers grows. At the same time, the tools available to defenders are improving rapidly. The wallets that treat security as a continuous process rather than a static feature will likely earn greater trust over time.
I have watched the space long enough to recognize cycles. Every few years a new attack vector appears, causes real damage, and then drives meaningful improvements. The current focus on signing-time analysis and AI-driven domain detection feels like one of those productive responses. It addresses the actual methods attackers are using today rather than the methods they used three years ago.
For everyday users the message is straightforward. Choose tools that actively inspect transactions before they execute. Stay informed about the kinds of permissions being requested. Maintain the habit of skepticism even when everything looks familiar. Those practices, combined with stronger automated defenses, make the self-custody experience both safer and more sustainable.
The rise in detections is concerning on the surface. Yet the ability of modern systems to identify threats that never appear on public lists is genuinely encouraging. Security is never finished. It is a constant process of observation, adaptation, and refinement. The latest expansion of AI checks inside a major wallet is a concrete step in the right direction, and one worth paying attention to as the landscape continues to evolve.
In the end, the goal remains the same. Users should be able to interact with decentralized applications, make payments, and manage their assets without constant fear that a single click will erase their holdings. Better detection, clearer communication of risk, and thoughtful design all contribute to that outcome. The data from the third and early fourth quarters of 2026 suggests the industry is taking the challenge seriously. That is welcome news for anyone who values true ownership of their digital assets.
