Bybit Exchange Safety 2026: After North Korean Hack

Explore Bybit's 2026 security posture following the February 2025 North Korean supply‑chain attack that stole $1.5 billion, detailing new safeguards, risk mitigation, and enhanced user protection.

Title: Bybit Exchange Safety in 2026 – Security Assessment After the North Korean Hack

Bybit has become one of the most recognizable names in the global cryptocurrency market, boasting millions of users and a suite of trading products that range from spot markets to perpetual futures. Yet the exchange’s reputation was dramatically tested on February 21 2025, when a sophisticated supply‑chain attack orchestrated by a North Korean hacking group resulted in the loss of roughly $1.5 billion (about 401,347 ETH). The incident sparked a flood of “scam” accusations and left traders wondering whether Bybit can still be trusted.

This guide breaks down the facts that have emerged up to April 2026, examines the technical details of the breach, evaluates the steps Bybit has taken to harden its platform, and offers practical advice for anyone who continues to use the exchange. The aim is to provide a clear, evidence‑based picture of Bybit’s current security posture—no speculation, no hype.

1. Bybit’s Pre‑2025 Reputation

Before the February 2025 breach, Bybit was generally regarded as a fast, user‑friendly centralized exchange (CEX). Its key strengths included:

High liquidity across major crypto pairs, which attracted professional traders.
Robust API and low‑latency order execution, making it popular for algorithmic strategies.
Regulatory outreach, with Bybit obtaining licenses in multiple jurisdictions (e.g., the British Virgin Islands, Singapore, and the EU’s MiCA framework).

These attributes helped Bybit amass a global user base, but they also made it a tempting target for sophisticated threat actors.

2. The February 2025 Security Breach – What Actually Happened?

2.1 Attack Vector: A Supply‑Chain Compromise

The incident was not a classic “brute‑force” hack of Bybit’s internal servers. Instead, investigators from TRM Labs, Chainalysis, and the FBI concluded that the North Korean Lazarus Group exploited a third‑party vendor that provided transaction‑signing software. By injecting malicious code into the vendor’s release pipeline, the attackers were able to:

Intercept transaction approvals on Bybit’s withdrawal workflow.
Forge signatures that appeared legitimate to Bybit’s internal controls.
Execute a series of transfers that moved 401,347 ETH (≈ $1.5 billion) to wallets under the hackers’ control.

The attack leveraged “clear signing” gaps—Bybit’s system relied heavily on software‑based signatures rather than hardware‑based verification for large withdrawals.

2.2 Immediate Impact

Financial loss: Approximately $1.5 billion was siphoned in a matter of hours.
User confidence: Many traders reported panic withdrawals and a surge in “scam” rumors across social media.
Regulatory scrutiny: Authorities in the United States, South Korea, and the EU opened investigations into Bybit’s vendor management practices.

3. Bybit’s Response and Security Overhaul (2025‑2026)

Following the breach, Bybit launched a multi‑phase remediation plan that can be grouped into three core pillars: Vendor Management, Transaction Verification, and Transparency.

3.1 Strengthening Vendor Security

Comprehensive risk assessments for all third‑party providers, with quarterly audits conducted by an independent cybersecurity firm.
Mandatory code‑signing certificates for any software that interacts with withdrawal processes.
Zero‑trust network segmentation, isolating vendor‑supplied components from core trading infrastructure.

3.2 Implementing “Clear Signing”

Bybit migrated to a hardware‑rooted signing model:

Hardware Security Modules (HSMs) now generate and store private keys used for withdrawal approvals.
Multi‑factor approval is required for any transaction exceeding a predefined threshold (e.g., $100,000).
Real‑time audit logs are broadcast to a public blockchain ledger, allowing external observers to verify that no unauthorized signatures were produced.

3.3 Enhancing Transparency and Cooperation

Public incident report released in March 2025, detailing the attack timeline and remediation steps.
Ongoing collaboration with the FBI, Interpol, and blockchain analytics firms to trace stolen funds. As of April 2026, approximately 12 % of the stolen ETH has been recovered or frozen on exchanges that cooperate with law enforcement.
User‑focused communication: Bybit introduced an in‑app security dashboard that shows recent withdrawal attempts, IP addresses, and device fingerprints.

4. Is Bybit a Scam?

The short answer is no. Bybit remains a legally incorporated exchange that provides legitimate trading services. The distinction is important:

Scam implies intentional fraud—misleading users, stealing funds, or operating a Ponzi scheme. Bybit has not been shown to engage in such conduct.
Victim of a hack means the platform was compromised by external actors despite having security controls in place. The 2025 breach falls into the latter category.

Nevertheless, the incident exposed governance weaknesses, especially around third‑party risk. Traders should treat Bybit—as with any CEX—with a healthy dose of due diligence.

5. Practical Steps to Safeguard Your Funds on Bybit (and Any Exchange)

Even with Bybit’s upgraded defenses, users retain the primary responsibility for protecting their assets. Follow these numbered steps:

Enable Full‑Scope 2FA – Use a time‑based one‑time password (TOTP) app rather than SMS.
Set Withdrawal Whitelists – Restrict outgoing transfers to pre‑approved wallet addresses.
Use Hardware Wallets for Long‑Term Storage – Keep the bulk of your crypto offline; only move what you need for active trading.
Monitor Account Activity – Regularly review the security dashboard for unfamiliar IPs or device signatures.
Keep Software Updated – Ensure your browser, operating system, and any authentication apps are patched against known vulnerabilities.
Limit Exposure – Avoid keeping more than a few percent of your portfolio on any single exchange, regardless of its reputation.

By following these practices, you reduce the risk of loss from both platform‑level incidents and personal credential compromise.

FAQ

Q1: Did Bybit lose any user funds in the 2025 hack?

A: The stolen $1.5 billion consisted of assets that were held in Bybit’s hot‑wallet pool for withdrawal processing. Bybit reimbursed affected users from its insurance reserve and capital reserves, but the incident highlighted the need for stronger segregation of funds.

Q2: How can I verify that a withdrawal request on Bybit is genuine?

A: Use the in‑app security dashboard to check the transaction’s signing method. Genuine withdrawals will show a hardware‑based signature generated by Bybit’s HSM and will be accompanied by a multi‑factor approval log.

Q3: Is it safe to trade high‑leverage products on Bybit after the breach?

A: Bybit’s trading engine and margin infrastructure were not directly compromised. However, high‑leverage trading inherently carries market risk, and users should ensure they understand those risks and have appropriate risk‑management controls in place.

Conclusion

Bybit’s 2025 supply‑chain breach was a watershed moment for the cryptocurrency industry, demonstrating that even well‑funded, globally recognized exchanges can fall prey to sophisticated state‑backed actors. The exchange’s response—overhauling vendor vetting, adopting hardware‑rooted signing, and increasing transparency—has restored a significant portion of user confidence.

As of April 2026, Bybit is operational, compliant, and markedly more secure than it was before the attack. It is not a scam, but it is a platform that, like all centralized services, carries inherent custodial risk. Traders who choose to remain on Bybit should complement the exchange’s improvements with personal security best practices, such as hardware wallet storage, two‑factor authentication, and withdrawal whitelists.

In the rapidly evolving crypto landscape, vigilance is a shared responsibility. By staying informed about security incidents and the measures taken to address them, users can make smarter decisions about where and how to trade—whether on Bybit or any other venue.

Recommended Exchanges

Looking for a reliable crypto exchange? Consider these top platforms:

Binance — World's largest crypto exchange with 350+ trading pairs. Sign up here with code B2345 for fee discounts
OKX — Professional derivatives and Web3 wallet in one platform. Sign up here with code B2345 for new user rewards