Bybit Hack Exposes $1.5B Gap in Cold Wallet Security

The Bybit hack proved that even cold storage is not immune during transfers. Attackers watched the signing ceremony and intercepted the transaction. The U.S. Federal Bureau of Investigation later linked the attack to North Korea's Lazarus Group, according to a Bureau statement.

Security experts at firms like Chainalysis and TRM Labs have recommended a hybrid approach. Active trading balances covering 30 to 90 days of expected activity stay on exchanges. The rest goes to hardware wallets or multisig cold storage. Two-factor authentication, withdrawal whitelists, and account locks add layers to exchange accounts.

A portfolio under $1,000 that trades daily may not justify the $47 to $399 cost of a hardware wallet. A portfolio exceeding $10,000 with infrequent trading should prioritise self-custody, given the pattern of exchange failures, several analysts said.

Regulatory changes are shifting the landscape. The SEC rescinded Staff Accounting Bulletin 121 in January 2025 through SAB 122. Custodians no longer have to record the full value of customer crypto assets as balance-sheet liabilities. Instead they recognise only the estimated risk of loss. That change could affect exchange insurance structures, though no major policy has been announced.

Exchange platforms continue investing in proof-of-reserves audits. Binance held $152.9 billion in verified user assets during the first quarter of 2026, the exchange said. But proof of reserves does not insure against a hack. The Bybit funds were gone before any audit could flag them.

The safest approach remains layered security. No single wallet type offers absolute protection. Exchanges provide regulated infrastructure but create a single point of failure. Hardware wallets remove third-party risk but demand disciplined backup habits. The $3.4 billion stolen in 2025 is a reminder that both models have blind spots, and attackers are probing them.