Bitget Wallet Flags 37,000 Weekly Phishing Alerts in Q3 Surge

Bitget Wallet recorded a sevenfold increase in crypto phishing risk alerts during the third quarter, highlighting growing security challenges across non-custodial software. The platform flagged approximately 37,000 malicious signing requests every week throughout Q3, pointing to both escalating threat activity and upgraded detection capabilities.

Security teams at the provider emphasized that internal monitoring upgrades were a primary driver behind the surge in identified threats. As decentralized finance ecosystems expand, automated security filters play an increasingly central role in shielding retail capital from sophisticated draining contracts.

The scale of the Q3 phishing alert surge

During the third quarter, security telemetry across the Bitget Wallet network flagged tens of thousands of illicit interactions every seven days. The platform identified roughly 37,000 weekly signing requests tied directly to phishing infrastructure, representing a sevenfold rise compared to previous baseline figures.

These numbers reflect a sharp acceleration in automated vector scans targeting web3 application users. Scammers frequently deploy deceptive smart contracts that request approval signatures to sweep funds from user balances without triggering traditional transaction warnings.

Attackers test wallet defences constantly.

The volume of flagged interactions highlights the persistent targeting of active self-custody addresses across multiple blockchain networks. With 37,000 weekly alerts triggered in Q3 alone, the frequency of malicious authorization attempts signals an ongoing push by threat actors to exploit blind signing habits among active traders.

How improved monitoring changes the numbers

Bitget Wallet indicated that enhanced security tracking and updated threat detection protocols were key drivers behind the sevenfold jump in alerts. Rather than indicating solely a sudden expansion in cybercrime, the spike reflects more effective real-time screening of incoming decentralized application requests.

Modern wallet security frameworks inspect contract bytecode and domain reputations before presenting signature requests to users. When tracking algorithms improve, existing malicious activity that previously slipped past basic filters suddenly becomes visible in official metrics.

Upgraded monitoring infrastructure allows software wallets to cross-reference request metadata against known blacklists and heuristic threat models. By flagging approximately 37,000 dangerous requests weekly, enhanced security layers prevent users from unintentionally executing harmful approvals that grant token permissions to external addresses.

Why are phishing signatures becoming more dangerous?

Phishing signatures are becoming more dangerous because malicious smart contracts can exploit off-chain approvals to drain assets without requiring immediate gas fees from the victim. Token approval standards like Permit and Permit2 allow users to sign structured messages that grant third parties permission to transfer tokens at a later time.

When traders interact with compromised decentralized applications or spoofed websites, they often sign messages without realizing they are granting full spending allowances. Once signed, the authorization payload is transmitted to an execution contract that immediately transfers the victim's funds to an external wallet.

Unlike standard native token transfers, approval-based exploits can remain dormant until triggered by an attacker. This delayed execution mechanism makes manual verification difficult for casual traders, increasing reliance on automated wallet alerts to intercept dangerous signature requests before approval.

The broader security environment in self-custody

Self-custody software faces a continuous arms race between security developers and malicious actors attempting to intercept user funds. Non-custodial platforms hand complete private key control to end users, shifting the responsibility of transaction verification onto individual account holders.

Threat actors rely heavily on social engineering, malicious search engine ads, and compromised social media accounts to route users toward fraudulent interfaces. These malicious interfaces mirror popular decentralized exchanges, staking platforms, or token claim pages to trick users into approving malicious payload requests.

As decentralized application ecosystems expand across layer-1 and layer-2 networks, transaction complexities multiply. The increased variety of smart contract interactions creates broader surface area for malicious approvals, reinforcing the need for continuous monitoring upgrades across multi-chain wallet applications.

What does this surge mean for crypto traders?

This surge means crypto traders must treat every transaction prompt with heightened scrutiny and rely on wallet-level security tools to verify approval permissions. The sevenfold increase in detected alerts demonstrates that active addresses encounter malicious signature requests with high frequency during routine web3 interactions.

Traders who regularly interact with decentralized exchanges, yield farms, and non-fungible token marketplaces face elevated exposure to phishing vectors. Ignoring automated warnings or relying on visual inspection alone increases the likelihood of signing compromised permit requests.

Security experts recommend regularly revoking active token allowances through dedicated allowance management tools. Setting custom spending limits rather than approving unlimited token allowances can also minimize potential losses if a contract signature is compromised in a phishing attempt.

What to watch next in wallet security

Security analysts will closely track whether weekly phishing alerts remain at the 37,000 level in coming quarters or shift alongside broader market activity. Future reports will reveal whether enhanced detection tools permanently suppress successful drain attempts or force attackers to change their delivery methods.

Wallet developers are moving toward clearer transaction simulation features that show exact balance changes before a user confirms a signature. The adoption of smart contract wallets and account abstraction standards may also introduce built-in policy controls that block suspicious spending requests automatically.

Key metrics to monitor include the ratio of flagged requests to total wallet transactions and the adoption rate of multi-factor signature approvals. Regulatory discussions around web3 security standards and user protection requirements may also influence how wallet providers deploy monitoring systems in future software updates.