← Articles

Crypto Exchange Security: What the Bybit Hack Taught About Trust

Crypto exchange security is now a growth problem, because 63% of US adults doubt crypto is safe. The $1.46 billion Bybit hack shows how fast, provable proof of solvency can keep users when everything goes wrong.

By Zayn, Growth research team··7 min read

Key takeaways

Key takeaways

  • Crypto exchange security is a conversion problem as much as an engineering one, because Pew Research found 63% of American adults have little or no confidence that crypto is safe or reliable.

  • Bybit lost $1.46 billion to North Korean hackers in February 2025 but kept its users, processing 99.994% of more than 350,000 withdrawal requests within 12 hours and publishing third-party proof of full reserves within 72 hours.

  • Audit badges don't prove safety, since CoinGecko found 60% of hacked platforms had passed an audit, so exchanges and protocols should publish proof of reserves every month and write their crisis plan before they need it.

Crypto exchange security is usually filed under engineering, but for most of your possible users it's the first thing they want to know before they'll sign up. Ask a founder about their conversion problem and you'll hear about copy, funnels and gas fees, while the people who never converted give a different answer. Pew Research found that 63% of American adults have little or no confidence that crypto is reliable or safe, and that isn't a fringe objection but the market telling you the price of entry.

The fear is earned. Chainalysis counted $2.17 billion stolen from crypto services in the first half of 2025 alone, more than in all of 2024, and the full year closed at over $3.4 billion, at least $2 billion of it taken by North Korean state hackers. This year hasn't been calmer, since CertiK logged $1.31 billion in losses across 344 incidents in the first half of 2026, about 28% more than the same period of 2025 once the Bybit theft is set aside. Every one of those headlines lands on your funnel, whether or not the hack was yours.

Most teams treat security as a page in the footer, while users treat it as the price.

How did Bybit get hacked?

Bybit was hacked in February 2025 when attackers linked to North Korea's Lazarus Group planted malicious code in the Safe{Wallet} interface Bybit used to approve transactions. The signers saw a normal-looking transfer but actually approved a change that handed control of an Ethereum cold wallet to the hackers, who took about $1.46 billion.

According to Bybit's incident timeline, forensic firms traced the root cause to malicious JavaScript on Safe{Wallet}'s platform that spoofed the transaction details, and it remains the largest theft in crypto history. Based on precedent, it should have been the end of the exchange. The Defiant studied the five biggest DeFi hacks and found that each protocol lost at least 96% of its deposits afterward and never recovered.

The one hack where the users stayed

Bybit's chart did something else, and the reason is the response. The exchange never froze withdrawals, and its timeline shows that 99.994% of more than 350,000 withdrawal requests were processed within 12 hours, $1.23 billion in ETH was brought in through loans, deposits and purchases within two days, and the auditor Hacken confirmed within 72 hours that key assets were backed at more than 100%. Glassnode's follow-up report, co-written with Bybit so read it with that in mind, tracked reserves rebuilding from 236,000 to 729,000 ETH and market share recovering within a quarter.

Put those outcomes side by side and the difference wasn't the hack, because everyone gets hacked eventually. The difference was that one team could prove within hours, with someone else's signature on the proof, that user money was safe and moving, and that proof was built before the crisis rather than during it.

Do security audits and insurance keep an exchange safe?

Not on their own. CoinGecko found that 60% of platforms hacked between January 2025 and July 2026 had passed a security audit, and only about 11% of the breaches involved something the audit had covered. Most large losses now come from wallet and operational compromises that code audits never examine.

The same CoinGecko security report found crypto insurance coverage shrank 20% even as hacks rose, so the industry's two standard trust signals, the audit badge and the insurance policy, are turning out to be insufficient and disappearing. CertiK's first-half 2026 data points the same way, with wallet compromises costing $444.5 million across just 33 incidents while code bugs caused 204 incidents but only $151.6 million in losses. The biggest loss of the year so far, $291 million at Kelp DAO, came from a compromise of the infrastructure it used to read the blockchain rather than a flaw in its code.

What is proof of reserves, and why does the rhythm matter?

Proof of reserves is a public report, usually checked by a third party, showing that an exchange holds at least as many assets as it owes its customers. The strongest versions let each user confirm their own balance was counted, and they're published on a fixed schedule rather than once after a scare.

What actually reads as trust is rhythm. A report published every month and checkable by anyone is a different kind of signal from an audit done eighteen months ago. Bitget, for example, published its 45th consecutive monthly report in September 2026, showing a 122% reserve ratio and letting users verify their own balances, and that rhythm says something no certificate can, which is that the exchange expects to be checked constantly and builds like it. It's the same logic that keeps Tether's reserve reports at the center of every argument about USDT.

What we'd tell a founder about crypto exchange security

Publish proof on a schedule, not a badge on a wall. Monthly proof of reserves, open dashboards and custody arrangements explained in public are the minimum. The audit is table stakes, but the rhythm is the differentiator, and it compounds because every report you publish makes a competitor's silence louder.

Write the crisis plan before the crisis. Bybit's 12-hour response wasn't improvisation, because it ran on plumbing and drills that existed in advance. Decide now who speaks, what gets published, how withdrawals keep moving and which third party confirms your numbers, since the first day of a crisis is the most attention your brand will ever get.

Translate the guarantees into human language. "Audited by two firms" means nothing to the 63%, while "your money stays withdrawable even on our worst day, and here's the day we proved it" means everything. Write your security page for a nervous newcomer rather than another engineer, in the same plain register that made stablecoins boring on purpose.

Put safety at the top of the funnel, not the bottom. If two-thirds of your possible market stays away out of fear, proof of safety is acquisition content rather than a compliance page. Teams competing on features are fighting over the third of the market that's already in, while the trust message is aimed at everyone crypto marketing keeps missing.

Crypto marketing spends nearly all its energy on people who already believe, while the numbers say the real prize is the majority who don't. That audience won't be won with higher yields or better memes but by whoever makes safety boring, provable and constant, and then says so in plain language. The worst theft in history showed that trust, handled well, survives almost anything, and the charts of every other major hack show what happens when it's handled late.

Frequently asked questions

Which is the most secure crypto exchange?

No exchange can prove it will never be hacked, so judge by evidence rather than claims. Look for monthly proof of reserves you can verify yourself, clear custody and cold storage disclosures, and a track record in a real incident. Bybit showed the value of that preparation in 2025, paying out 99.994% of withdrawal requests within 12 hours of a $1.46 billion theft.

Is Bybit safe after the hack?

Bybit closed its ETH shortfall with bridge loans, large deposits and market purchases, bringing in $1.23 billion within two days, and had Hacken confirm key assets were backed at more than 100% within 72 hours. Its reserves rebuilt from 236,000 to 729,000 ETH afterward. As with any exchange, users should check its latest proof of reserves before depositing.

What is proof of reserves in crypto?

Proof of reserves is a report showing an exchange holds enough assets to cover every customer balance, usually verified by a third party and often using a Merkle tree so each user can confirm their own balance was included. The best programs publish monthly, such as Bitget, which released its 45th consecutive monthly report in September 2026.

How much crypto was stolen in 2025?

More than $3.4 billion was stolen from crypto services in 2025, with at least $2 billion taken by North Korean state hackers. The single largest theft was the $1.46 billion Bybit hack in February. In the first half of 2026, CertiK recorded a further $1.31 billion in losses across 344 incidents.

Does a smart contract audit prevent hacks?

An audit reduces risk but doesn't prevent most large losses. CoinGecko found 60% of platforms hacked between January 2025 and July 2026 had been audited, and only about 11% of breaches involved code the audit covered. Most major thefts now come from compromised wallets, keys and infrastructure rather than smart contract bugs.



← Articles

Crypto Exchange Security: What the Bybit Hack Taught About Trust

Crypto exchange security is now a growth problem, because 63% of US adults doubt crypto is safe. The $1.46 billion Bybit hack shows how fast, provable proof of solvency can keep users when everything goes wrong.

By Zayn, Growth research team··7 min read

Key takeaways

Key takeaways

  • Crypto exchange security is a conversion problem as much as an engineering one, because Pew Research found 63% of American adults have little or no confidence that crypto is safe or reliable.

  • Bybit lost $1.46 billion to North Korean hackers in February 2025 but kept its users, processing 99.994% of more than 350,000 withdrawal requests within 12 hours and publishing third-party proof of full reserves within 72 hours.

  • Audit badges don't prove safety, since CoinGecko found 60% of hacked platforms had passed an audit, so exchanges and protocols should publish proof of reserves every month and write their crisis plan before they need it.

Crypto exchange security is usually filed under engineering, but for most of your possible users it's the first thing they want to know before they'll sign up. Ask a founder about their conversion problem and you'll hear about copy, funnels and gas fees, while the people who never converted give a different answer. Pew Research found that 63% of American adults have little or no confidence that crypto is reliable or safe, and that isn't a fringe objection but the market telling you the price of entry.

The fear is earned. Chainalysis counted $2.17 billion stolen from crypto services in the first half of 2025 alone, more than in all of 2024, and the full year closed at over $3.4 billion, at least $2 billion of it taken by North Korean state hackers. This year hasn't been calmer, since CertiK logged $1.31 billion in losses across 344 incidents in the first half of 2026, about 28% more than the same period of 2025 once the Bybit theft is set aside. Every one of those headlines lands on your funnel, whether or not the hack was yours.

Most teams treat security as a page in the footer, while users treat it as the price.

How did Bybit get hacked?

Bybit was hacked in February 2025 when attackers linked to North Korea's Lazarus Group planted malicious code in the Safe{Wallet} interface Bybit used to approve transactions. The signers saw a normal-looking transfer but actually approved a change that handed control of an Ethereum cold wallet to the hackers, who took about $1.46 billion.

According to Bybit's incident timeline, forensic firms traced the root cause to malicious JavaScript on Safe{Wallet}'s platform that spoofed the transaction details, and it remains the largest theft in crypto history. Based on precedent, it should have been the end of the exchange. The Defiant studied the five biggest DeFi hacks and found that each protocol lost at least 96% of its deposits afterward and never recovered.

The one hack where the users stayed

Bybit's chart did something else, and the reason is the response. The exchange never froze withdrawals, and its timeline shows that 99.994% of more than 350,000 withdrawal requests were processed within 12 hours, $1.23 billion in ETH was brought in through loans, deposits and purchases within two days, and the auditor Hacken confirmed within 72 hours that key assets were backed at more than 100%. Glassnode's follow-up report, co-written with Bybit so read it with that in mind, tracked reserves rebuilding from 236,000 to 729,000 ETH and market share recovering within a quarter.

Put those outcomes side by side and the difference wasn't the hack, because everyone gets hacked eventually. The difference was that one team could prove within hours, with someone else's signature on the proof, that user money was safe and moving, and that proof was built before the crisis rather than during it.

Do security audits and insurance keep an exchange safe?

Not on their own. CoinGecko found that 60% of platforms hacked between January 2025 and July 2026 had passed a security audit, and only about 11% of the breaches involved something the audit had covered. Most large losses now come from wallet and operational compromises that code audits never examine.

The same CoinGecko security report found crypto insurance coverage shrank 20% even as hacks rose, so the industry's two standard trust signals, the audit badge and the insurance policy, are turning out to be insufficient and disappearing. CertiK's first-half 2026 data points the same way, with wallet compromises costing $444.5 million across just 33 incidents while code bugs caused 204 incidents but only $151.6 million in losses. The biggest loss of the year so far, $291 million at Kelp DAO, came from a compromise of the infrastructure it used to read the blockchain rather than a flaw in its code.

What is proof of reserves, and why does the rhythm matter?

Proof of reserves is a public report, usually checked by a third party, showing that an exchange holds at least as many assets as it owes its customers. The strongest versions let each user confirm their own balance was counted, and they're published on a fixed schedule rather than once after a scare.

What actually reads as trust is rhythm. A report published every month and checkable by anyone is a different kind of signal from an audit done eighteen months ago. Bitget, for example, published its 45th consecutive monthly report in September 2026, showing a 122% reserve ratio and letting users verify their own balances, and that rhythm says something no certificate can, which is that the exchange expects to be checked constantly and builds like it. It's the same logic that keeps Tether's reserve reports at the center of every argument about USDT.

What we'd tell a founder about crypto exchange security

Publish proof on a schedule, not a badge on a wall. Monthly proof of reserves, open dashboards and custody arrangements explained in public are the minimum. The audit is table stakes, but the rhythm is the differentiator, and it compounds because every report you publish makes a competitor's silence louder.

Write the crisis plan before the crisis. Bybit's 12-hour response wasn't improvisation, because it ran on plumbing and drills that existed in advance. Decide now who speaks, what gets published, how withdrawals keep moving and which third party confirms your numbers, since the first day of a crisis is the most attention your brand will ever get.

Translate the guarantees into human language. "Audited by two firms" means nothing to the 63%, while "your money stays withdrawable even on our worst day, and here's the day we proved it" means everything. Write your security page for a nervous newcomer rather than another engineer, in the same plain register that made stablecoins boring on purpose.

Put safety at the top of the funnel, not the bottom. If two-thirds of your possible market stays away out of fear, proof of safety is acquisition content rather than a compliance page. Teams competing on features are fighting over the third of the market that's already in, while the trust message is aimed at everyone crypto marketing keeps missing.

Crypto marketing spends nearly all its energy on people who already believe, while the numbers say the real prize is the majority who don't. That audience won't be won with higher yields or better memes but by whoever makes safety boring, provable and constant, and then says so in plain language. The worst theft in history showed that trust, handled well, survives almost anything, and the charts of every other major hack show what happens when it's handled late.

Frequently asked questions

Which is the most secure crypto exchange?

No exchange can prove it will never be hacked, so judge by evidence rather than claims. Look for monthly proof of reserves you can verify yourself, clear custody and cold storage disclosures, and a track record in a real incident. Bybit showed the value of that preparation in 2025, paying out 99.994% of withdrawal requests within 12 hours of a $1.46 billion theft.

Is Bybit safe after the hack?

Bybit closed its ETH shortfall with bridge loans, large deposits and market purchases, bringing in $1.23 billion within two days, and had Hacken confirm key assets were backed at more than 100% within 72 hours. Its reserves rebuilt from 236,000 to 729,000 ETH afterward. As with any exchange, users should check its latest proof of reserves before depositing.

What is proof of reserves in crypto?

Proof of reserves is a report showing an exchange holds enough assets to cover every customer balance, usually verified by a third party and often using a Merkle tree so each user can confirm their own balance was included. The best programs publish monthly, such as Bitget, which released its 45th consecutive monthly report in September 2026.

How much crypto was stolen in 2025?

More than $3.4 billion was stolen from crypto services in 2025, with at least $2 billion taken by North Korean state hackers. The single largest theft was the $1.46 billion Bybit hack in February. In the first half of 2026, CertiK recorded a further $1.31 billion in losses across 344 incidents.

Does a smart contract audit prevent hacks?

An audit reduces risk but doesn't prevent most large losses. CoinGecko found 60% of platforms hacked between January 2025 and July 2026 had been audited, and only about 11% of breaches involved code the audit covered. Most major thefts now come from compromised wallets, keys and infrastructure rather than smart contract bugs.