Overview
- Bybit reported in its H1 2026 Risk & Security Report that its systems intercepted more than 30,000 suspicious withdrawal requests and prevented over $700 million in potential user losses during the first half of 2026.
- The exchange rebuilt a three‑layer defence after the Feb. 21, 2025 theft that drained about 400,000 ETH, adding broad account protections, continuous on‑chain surveillance and AI‑assisted security operations with 100% coverage of business‑relevant on‑chain activity.
- Bybit says AI processed more than 100,000 security alerts, helped find high‑severity vulnerabilities at three to five times the manual rate, automated red‑team testing of 1,489 public assets, and cut some audit‑to‑test cycles from roughly two weeks to about two hours.
- Parallel to technical steps, Bybit filed a U.S. civil suit against North Korea, the Reconnaissance General Bureau and the Lazarus Group and obtained a preliminary injunction to preserve assets while discovery and tracing continue.
- Industry limits on recovery remain: attackers moved large shares of the stolen funds through mixers, cross‑chain bridges and OTC channels, making most of the original $1.46 billion hard to recover and underscoring the need for cross‑exchange coordination and human review alongside automation.