Bybit

The largest theft in the history of this industry

On or about 21 February 2025, attackers took roughly $1.5bn in virtual assets from Bybit. The FBI attributed it publicly five days later to North Korea, under the name it gives that activity: "The Federal Bureau of Investigation (FBI) is releasing this PSA to advise the Democratic People’s Republic of Korea (DPRK) was responsible for the theft of approximately $1.5 billion USD in virtual assets from cryptocurrency exchange, Bybit" 1.

The mechanism matters for what it says about everyone else. The theft happened during a routine transfer from a cold wallet to a hot one, with the attackers intercepting and rerouting the funds — not by breaking the exchange’s perimeter but by corrupting a signing process. The FBI asked node operators, exchanges, bridges and analytics firms to block addresses derived from the stolen assets and published a list of them 1. This is a state actor, and no exchange on this list should be assumed out of reach of it.

What happened next, which is the part that scores

Bybit did not halt withdrawals, and restored reserves to a one-to-one ratio for in-scope assets within 72 hours, partly through emergency borrowing. A fresh proof-of-reserves audit by Hacken on 23 February verified reserves covering user assets across 40 asset types, with the major assets above 100% collateral 3.

That is the distinction this site’s security component is built on: an exchange that was hacked and covered every loss is not in the same category as one that was hacked and did not. Users were made whole. The record marks the breach, marks the recovery, and scores the difference — which is why a company that lost more money in one day than most of this list has ever held does not finish last.

Separately, Japan’s Financial Services Agency named Bybit Fintech Limited of Dubai on its list of firms conducting crypto-asset exchange business with Japanese residents without registration, warned on 28 November 2024 2. Three other exchanges on this page are on the same list, warned the same day.

A judgement call in our own record, stated rather than buried

This record marks Bybit as publishing a proof of reserves and as having no third-party audit, and the two look contradictory next to a paragraph that credits an audit by Hacken 3. They are not, and the distinction is the most useful thing on this page for reading any of the others.

A proof-of-reserves attestation checks that wallets an exchange points at hold what it says they hold, on the day somebody looks. A financial audit checks a company’s accounts: both sides, assets against what is owed, by a firm with professional liability for getting it wrong. Hacken is a named third party doing the first thing competently; it is not doing the second, and neither is anybody else here except the auditors of the one listed company.

So the field stays false, and this paragraph exists because a reader is entitled to see the call being made rather than discover it in a scoring function. If somebody disagrees with where that line sits, the argument is here to have.