Is Bybit Safe in 2026? Security, Hack History, Verdict
Bybit is one of the largest crypto exchanges and remains operational and solvent in 2026, but it survived the biggest hack in crypto history. In February 2025, North Korea’s Lazarus Group stole about $1.5B in Ethereum via a compromised wallet-signing interface. Bybit kept withdrawals open and reportedly restored 1:1 reserves within days — no user funds were lost.
What happened in the February 2025 hack?
On February 21, 2025, attackers stole roughly $1.5 billion in ETH from Bybit — the largest cryptocurrency theft on record. The FBI attributed it to North Korea’s Lazarus Group (also tracked as TraderTraitor / APT38).
Crucially, Bybit’s own systems weren’t directly breached. The attackers compromised the development environment of the Safe{Wallet} tool Bybit used, tampering with the signing interface so a routine cold-wallet transfer was redirected. It was a supply-chain / signing attack, not a break of Bybit’s core code.
How did Bybit respond?
- Kept withdrawals open throughout the incident to prevent a bank run.
- Sourced emergency liquidity (loans and large deposits) to cover the gap.
- Reportedly restored 1:1 backing of user assets within ~72 hours.
- Published a public incident timeline and worked with investigators on fund tracing.
Is Bybit safe to use now?
For most users, Bybit functions as a major, liquid exchange in 2026 and demonstrated it could absorb a record loss without defaulting on customers. That’s a meaningful stress test most exchanges have never faced. Still, the hack underlines a universal rule: an exchange is a place to trade, not a long-term vault.
Safety checklist for any exchange
- Enable 2FA (authenticator app, not SMS) and a withdrawal address whitelist.
- Keep long-term holdings in self-custody (hardware wallet), not on the exchange.
- Confirm the exchange actually serves — and is licensed for — your country.
- Check for current proof-of-reserves and a clear incident-response track record.
Verdict
Bybit is a major exchange that passed an extreme stress test in 2025 by making users whole. It is reasonable to use for trading in supported countries, provided you follow basic self-custody and security hygiene. If Bybit doesn’t serve your country, see who accepts you.
We may earn a commission if you open an account via our links.
- BlockedUS, Canada, Singapore, Hong Kong, Chinese Mainland
We earn a commission if you sign up. It costs you nothing and does not change what we write.
Frequently asked questions
Did Bybit get hacked?
Yes. On February 21, 2025, about $1.5 billion in Ethereum was stolen — the largest crypto theft on record. The FBI attributed it to North Korea’s Lazarus Group. The breach came through a compromised wallet-signing tool, not Bybit’s core systems.
Did Bybit users lose money in the hack?
According to Bybit and widespread reporting, no user funds were lost. Bybit kept withdrawals open and restored 1:1 backing of customer assets within roughly 72 hours using emergency liquidity. Treat this as reported rather than independently audited.
Is Bybit safe to use in 2026?
Bybit operates as a major, liquid exchange and proved it could absorb a record loss without defaulting on customers. It is reasonable for trading in supported countries, but keep long-term holdings in self-custody and use strong 2FA.
Should I keep my crypto on Bybit?
Use any exchange for trading, not long-term storage. Keep significant holdings in a self-custody hardware wallet and only keep on the exchange what you are actively trading.
How did the February 2025 attackers get in?
Through a supply-chain weakness, not Bybit’s core code. The attackers compromised the development environment of the Safe{Wallet} tool Bybit used and tampered with the signing interface, so a routine cold-wallet transfer was redirected. The FBI attributed the theft to North Korea’s Lazarus Group, also tracked as TraderTraitor.
What should I do to protect my exchange account?
Enable 2FA with an authenticator app rather than SMS, and turn on a withdrawal-address whitelist. Keep long-term holdings in self-custody on a hardware wallet, confirm the exchange is licensed to serve your country, and check its current proof-of-reserves and incident-response track record before depositing.