Bybit Review: A $1.5 Billion Hack Later, Is It Still Safe to Trade?

Bybit is the exchange that lost $1.5 billion in a single transaction and kept its doors open the same week. That fact alone should shape how anyone reads the rest of this review: the fees are competitive and the liquidity is real, but the story starts with the largest crypto theft ever recorded, and what Bybit did next is most of why it is still worth discussing here.

What actually happened in February 2025

Attackers linked to North Korea's Lazarus Group compromised a developer's machine connected to the Gnosis Safe multisig wallet Bybit used for cold storage. They injected malicious code into the signing interface itself, so when Bybit's own signers approved what looked like a routine transfer, the screen showed one destination while the underlying transaction sent roughly $1.5 billion in ETH somewhere else entirely. Nothing about Bybit's servers or hot wallets was breached directly; the exploit targeted the human approval step at the exact moment it should have been safest.

Making users whole, fast

Within 72 hours, Bybit had closed the entire ETH shortfall through bridge loans, OTC purchases and support from partners including Galaxy Digital, FalconX and Wintermute, according to reporting at the time. Deposits, withdrawals and trading kept running throughout, and no customer lost funds because Bybit absorbed the loss on its own balance sheet rather than passing it on. A recovery bounty program offering up to 10 percent of any traced funds has since helped investigators follow the stolen assets through mixers and cross-chain bridges.

Checking the receipts instead of taking their word for it

Every exchange says it holds enough in reserve. Bybit has published monthly proof-of-reserves reports audited by Hacken since mid-2024, and its 31st snapshot in February 2026 reported reserve ratios at or above 100 percent across its major tracked assets. CoinMarketCap's own exchange page pulls the same figures directly.

Users can run their own Merkle-tree check against their account balance rather than trust a PDF, which is a meaningfully stronger claim than most exchanges make. None of that undoes the hack, but it is the kind of transparency an exchange only adopts once it has had to.