We checked Bybit's fee schedule, its country restrictions and its recovery from the largest crypto theft on record to answer one question directly: is a fast, liquid derivatives exchange worth the custodial risk after a breach this size?
Bybit's own site blocked our automated capture tools outright during this review, a small but telling detail for an exchange whose biggest story is a security failure. We pulled our data instead from CoinMarketCap's reserve tracking, Bybit's official incident timeline, and the app listings both major phone platforms still host for it. That reserve data is worth reading closely before anything else: it lists roughly $12.9 billion in total assets against Bitcoin, Ethereum and stablecoin balances that Bybit reports directly, the same kind of self-attested figure every centralized exchange asks customers to trust after a loss this size.
What happened on February 21, 2025
Attackers linked to North Korea's Lazarus Group, tracked under the subgroup name TraderTraitor, compromised the developer environment of Safe Wallet, a third-party multisignature tool Bybit used to move funds between cold and warm storage. By altering what Bybit's own signers saw on screen during a routine transfer, the attackers got legitimate Bybit operators to approve a transaction that actually redirected roughly $1.5 billion in ETH to wallets the attackers controlled. It stands as the largest single theft in crypto exchange history, larger than the Mt. Gox and FTX losses combined.
The recovery, and why it matters for a rating
What separates this from a collapse is what came next. Bybit says it covered the shortfall from its own reserves and processed close to $4 billion in customer withdrawal requests in the days after disclosure without freezing accounts or suspending redemptions, a stress test most exchanges never face and many would not survive without gating withdrawals. The exchange also stood up a Recovery Bounty Program offering 10% of any stolen funds returned or frozen, an incentive aimed at exchanges and mixers that unknowingly touch the stolen ETH. None of that undoes the breach, but a custodian that pays out in full during a crisis of this size deserves more credit than one that quietly changes its terms of service instead.
