A sevenfold surge in phishing risk alerts is not an anomaly to be explained away — it is a structural signal about where the crypto threat landscape is headed. Bitget Wallet disclosed that during the third quarter of 2026, its systems were flagging approximately 37,000 signing requests per week as suspected phishing activity, a figure that represents a dramatic escalation from prior periods and forces a serious conversation about the security architecture protecting everyday crypto users.

The company was careful to note that improved monitoring tools likely contributed to the spike in detected alerts — a standard and reasonable caveat when any security system undergoes upgrades. Better detection does surface more threats. But even accounting for that variable, a sevenfold increase is not a measurement artifact. It is a window into the volume and sophistication of phishing campaigns now targeting wallet users at the transaction-signing layer, one of the most consequential points of vulnerability in any self-custody setup.

Why Signing Requests Are the New Attack Surface

To understand the significance of these numbers, it helps to understand what a signing request actually represents. When a user interacts with a decentralized application — approving a token swap, minting an asset, authorizing a smart contract — their wallet prompts them to cryptographically sign a message or transaction. That signature is the proof of consent. Phishing attacks that target this layer do not need to steal a seed phrase or break encryption. They simply need to trick a user into signing something malicious: a transaction that drains funds, a permit that grants unlimited token allowances, or a blind signature that authorizes a hostile contract interaction.

This attack vector has matured considerably over the past two years. Early crypto phishing was relatively crude — fake websites, spoofed emails, counterfeit wallet apps. The generation of attacks now being detected by Bitget Wallet operates at a much higher level of sophistication, embedding malicious signing requests inside seemingly legitimate decentralized finance interfaces, airdrop claim pages, and non-fungible token minting portals. Users who understand seed phrase hygiene perfectly can still be compromised through a single ill-considered signature.

Detection at Scale Is Not the Same as Prevention

The 37,000-per-week figure deserves scrutiny beyond its headline shock value. That number represents flagged requests — alerts generated by Bitget Wallet's risk detection engine — not necessarily confirmed exploits or confirmed losses. Some portion of those flags may represent false positives or low-risk interactions that pattern-match to known phishing signatures. The company did not publicly disclose what percentage of flagged requests resulted in actual user harm, which is the metric that ultimately matters most for assessing user protection outcomes.

Nevertheless, detection at scale is a genuinely meaningful capability. Wallets that surface warnings at the moment of signing — before the irreversible action is taken — represent a materially different security posture than wallets that offer no pre-transaction risk analysis. The question is whether warnings are legible enough, well-timed enough, and urgent enough to change user behavior in the critical seconds before a signature is submitted. Interface design and warning language are not trivial engineering problems; they are the last line of defense when technical filters have done everything they can.

Industry-Wide Implications

Bitget Wallet's disclosure arrives as the broader crypto industry faces sustained pressure from regulators and institutional participants to demonstrate that retail users can be protected in self-custody environments. The argument for non-custodial wallets has always rested on the promise that users can hold assets without counterparty risk — but that promise is hollow if the attack surface at the signing layer remains largely ungoverned.

Other major wallet providers, including those serving users across the Ethereum ecosystem and beyond, have been developing transaction simulation tools, domain reputation scoring, and contract interaction risk ratings. The emergence of these capabilities reflects an industry-wide acknowledgment that raw cryptographic security is necessary but not sufficient. Human-layer attacks — social engineering dressed in Web3 clothing — require human-layer defenses baked directly into the wallet interface.

The sevenfold jump Bitget Wallet recorded in Q3 2026 should be read as both a company-specific data point and a sector-wide diagnostic. Phishing campaigns targeting signing requests are scaling. The attackers building them are iterating. And the wallets responsible for protecting users need detection infrastructure that scales at least as fast as the threats themselves — preferably faster.

What This Means

For users, the practical takeaway is straightforward but demanding: treat every signing request as a potential attack vector, regardless of how legitimate the interface appears. For wallet developers, the Bitget data makes the case for investing heavily in pre-signing risk analysis as a core product feature rather than a secondary safety add-on. And for the broader ecosystem, 37,000 suspicious signing requests flagged in a single week — during a single quarter, by a single wallet provider — suggests the actual industry-wide exposure is orders of magnitude larger than any single disclosure can capture. The phishing wave is not cresting. It is still building.

Written by the editorial team — independent journalism powered by Bitcoin News.