Bybit blocked $700M in potential losses after $1.46B hack

Bybit’s security systems blocked more than $700 million in potential user losses during the first half of 2026, the exchange said in its H1 Risk & Security Report. The figure comes a year after a $1.46 billion breach of its Ethereum cold wallet, later attributed to North Korean actors.

The report, covering Jan. 1 through June 15, described three layers of defence: user account controls, continuous on-chain monitoring, and AI-assisted security operations. Human specialists keep final say on critical decisions, the exchange said.

More than 30,000 suspicious withdrawal requests were intercepted during the period, protecting nearly 20,000 users. Initial risk reviews averaged 4.7 minutes, with 95% completed within 10 minutes.

Security teams also identified about $212 million in funds potentially connected to fraud and added more than 10,000 malicious blockchain addresses to Bybit’s blacklist, the report said. Behavioural analysis and AI-supported monitoring were used to detect transaction patterns linked to new fraud campaigns, the company said.

The February 2025 attack drained roughly 400,000 ETH and staked Ether from Bybit’s Ethereum cold wallet. The exchange said at the time it could cover the loss and continue processing customer withdrawals. U.S. authorities later linked the operation to North Korea’s Lazarus Group. Chainalysis estimated that North Korean actors stole about $2.02 billion in cryptocurrency during 2025, with the Bybit theft accounting for most of that total. The firm said cumulative crypto theft linked to North Korea had reached roughly $6.75 billion.

Bybit’s monitoring system now covers 100% of on-chain activity relevant to its business, including listed token contracts, ecosystem contracts, and the exchange’s cold, warm and hot wallets, the report said.

During H1, the system identified and handled 10 security incidents affecting token projects listed on the exchange. None caused losses to Bybit, the company said. Security teams completed emergency responses before other major exchanges in eight of those cases, and two incidents were detected before the affected projects had identified the attacks themselves.

Continuous monitoring has become a larger issue across the crypto sector. A July security report by Hacken, previously covered by crypto.news, found that compromised keys, signers and infrastructure accounted for 88.3% of roughly $764 million stolen during the second quarter of 2026. Hacken tracked 1,427 projects and found evidence of third-party monitoring at only 9% of them. Just 4% combined monitoring, an active bug bounty and an audit, the firm said.

Hacken also identified 14 projects that were exploited despite previously completing security audits. According to the firm, several attacks affected signer devices, administrator keys, backend systems, bridge validators or older contracts instead of the smart contract code examined during conventional audits.

AI has taken a larger role in Bybit’s defensive systems. The exchange said more than 100,000 security alerts received AI-assisted analysis during the first half of the year. According to the H1 report, AI-supported security audits detected high-severity vulnerabilities at three to five times the rate achieved through manual review. Automation also reduced the period between a security assessment and subsequent testing from about two weeks to roughly two hours.

Bybit’s automated red-team platform assessed 1,489 public-facing assets and identified more than 100 high-severity vulnerabilities. The exchange said the average time between discovering an asset and beginning initial penetration testing fell below 24 hours, compared with manual processes that could require weeks.

AI is used mainly to process information, find vulnerabilities and increase the speed of security testing, while specialists remain responsible for more complex decisions, the company said.