Bybit Says Security Upgrades Blocked $700M in Potential Losses After Major Hack

The exchange's 2026 security report credits new defenses with intercepting threats following last year's $1.46 billion breach

Bybit has disclosed that security measures put in place following a major hack have prevented approximately $700 million in potential losses. The figure comes from a 2026 security report published by the exchange, which frames the number as evidence that its post-breach defenses are working.

The upgrades followed a hack that cost Bybit an estimated $1.46 billion, one of the largest thefts in crypto exchange history. Investigators and multiple outlets have linked that breach to the Lazarus Group, a hacking operation with ties to North Korea. The group has been blamed for numerous crypto thefts over the years, often targeting exchange infrastructure and custody systems.

According to Bybit's report, the $700 million figure represents threats that were identified and stopped before funds could be moved out of user or platform wallets. The exchange has not detailed the exact methods used, but the report reportedly points to broader upgrades across custody, monitoring, and internal risk controls implemented since the earlier hack.

Exchange security has become a central concern for the crypto industry following a string of high-profile breaches over the past several years. Centralized exchanges hold large pools of user funds, making them attractive targets for sophisticated hacking groups. When a breach of Bybit's scale occurs, it tends to trigger scrutiny of custody practices across the sector, not just at the affected platform.

Bybit's decision to publish detailed loss-prevention figures fits a pattern among exchanges seeking to rebuild user trust after security incidents. Transparency reports of this kind are increasingly used to reassure customers and counterparties that lessons from past breaches have translated into concrete operational changes. Whether the $700 million figure reflects actual attempted intrusions, simulated stress tests, or a mix of both was not specified in available reporting.

The timing of the report, arriving roughly a year and a half after the original hack, suggests Bybit is positioning the disclosure as part of a longer-term recovery narrative. Exchanges that suffer large breaches often face extended periods of reputational repair, particularly when state-linked hacking groups are implicated.

Market Impact

News of blocked threats at this scale is unlikely to move broader crypto markets on its own, but it carries weight for exchange users and institutional partners evaluating custody risk. Bybit's ability to demonstrate stronger defenses could influence trading volume and user retention decisions in a market where exchange security failures have previously triggered rapid outflows.

The disclosure also feeds into an ongoing industry conversation about how exchanges should respond to state-linked hacking threats. Competitors and regulators alike may point to Bybit's reporting as a benchmark for transparency, particularly given the scale of the earlier breach and its attribution to a group with a long history of targeting crypto infrastructure.

Bybit's disclosure underscores how deeply the earlier hack reshaped its security posture, and the $700 million figure will likely be cited as the exchange continues its post-breach recovery effort.

Frequently Asked Questions

What did Bybit report about its security upgrades?

Bybit said security enhancements made after a major hack stopped roughly $700 million in potential losses, according to a 2026 security report.

What hack is Bybit's report responding to?

The report follows a breach that cost Bybit an estimated $1.46 billion, which has been linked to the Lazarus Group.

Who is the Lazarus Group?

The Lazarus Group is a hacking operation with alleged ties to North Korea that has been blamed for numerous crypto exchange thefts.

Does the $700 million figure represent actual stolen funds?

No, Bybit describes the figure as potential losses that were prevented, not funds that were actually stolen.