Bybit CEO Ben Zhou has a blunt message for fellow exchange operators: stop planning around the idea that you won’t get hacked. Exchanges should treat attacks as a given and build multiple layers of protection so that when something breaks, the damage stays contained and the business survives, he said.
From breach victim to security advocate
On October 20, 2026, Zhou said exchanges must assume attacks will definitely occur and need protections built specifically to keep customer assets safe. The timing also matters: on October 29, 2026, amid reports of security incidents at Binance, Bybit confirmed it was unaffected and told users their assets remained secure.
The $1.5 billion lesson
Zhou’s views on preparedness were not formed in a vacuum. On February 21, 2025, Bybit lost approximately $1.5 billion, more than 401,000 ETH, from its Ethereum cold wallet—storage kept away from the constantly connected systems that handle day-to-day trading. The attack reached it anyway. The breach was a supply-chain attack carried out through compromised Safe{Wallet} infrastructure. The theft has been attributed to North Korea’s Lazarus Group, with the intrusion described as a phishing attack.
What happened next is arguably the more important part of the story. Bybit covered the full $1.5 billion loss from corporate reserves. Within 72 hours, it processed more than 350,000 withdrawal requests, and customers did not lose funds. Trading and withdrawals kept running for users during that stretch.
What Bybit changed
Since the breach, Bybit has rolled out expanded security measures, including enhanced multi-signature wallets and AI-assisted monitoring. Multi-signature wallets require several independent approvals before funds can move. The AI-assisted monitoring has blocked more than $700 million in suspicious transactions.
Why the industry should pay attention
For users, the most practical takeaway is that security is not a binary. Asking whether an exchange has been hacked tells you less than asking what happens to your money if it is. Bybit’s 2025 response offers one concrete answer: absorbing the loss with its own reserves while keeping withdrawals flowing meant the breach became the company’s problem rather than its customers’.
When reports of trouble surface at one platform, rivals now move quickly to publicly confirm their own status, as Bybit did on October 29, 2026. There is also a cooperative angle: supply-chain attacks like the one that hit Bybit target shared infrastructure, meaning a weakness in one widely used tool can expose many platforms at once.
