Mentioned in This Article
1. Why Bybit's chief executive says exchanges should plan for attacks
Bybit chief executive Ben Zhou has told other exchange operators to stop building their security around the hope that they will never be hacked. His position is that attacks should be treated as a certainty, and that platforms need several independent layers of protection so that a failure in one place does not become a failure of the whole business.
The message carries weight because Bybit has lived through the scenario it describes. On February 21, 2025, the exchange lost about $1.5 billion, more than 401,000 ether (ETH), from one of its Ethereum cold wallets. Zhou has since become one of the more visible executives arguing for a different security mindset across the industry.
His argument is practical rather than rhetorical. In his view, the useful question is not whether an exchange has ever been breached, but how much a breach costs customers and how quickly operations continue afterward. That framing shifts attention from prevention alone to containment and recovery.
2. What happened in the February 2025 Bybit hack?
The February 2025 theft was a loss of roughly $1.5 billion in ETH from a cold wallet, which is a storage arrangement meant to be the safest an exchange has. Cold wallets are kept apart from the constantly connected systems that handle daily trading, and are often compared to a bank vault as opposed to a cash register.
The attack reached that vault anyway. It was a supply-chain attack that ran through compromised infrastructure belonging to Safe{Wallet}, a widely used wallet tool, rather than through a direct break into Bybit's own servers. The theft has been attributed to North Korea's Lazarus Group, and the intrusion involved phishing.
The lesson often drawn from the incident is that even storage designed for maximum safety depends on the tools and people around it. A weakness in a single widely used product can open a path into many organisations at once, which is why supply-chain attacks are considered especially dangerous for the industry.
Phishing, in this context, means deceiving people who hold access into approving something they should not. It is a reminder that the human element is often the weakest link, even in systems with sophisticated cryptography. A transaction can look routine to the people signing it while carrying instructions that change what the wallet does, and this gap between what an approver sees and what actually executes is a central difficulty for any organisation that relies on manual sign-off.
3. How did Bybit respond to the loss?
Bybit's response is the part of the story Zhou points to most often. The exchange made good on the loss so that customers did not bear it, and within 72 hours it processed more than 350,000 withdrawal requests. Trading and withdrawals continued for users throughout that period.
That outcome matters for a basic reason. An exchange that suffers a major theft can fail a second time if customers rush to withdraw and the platform cannot pay. By meeting withdrawals in volume while the incident was still fresh, Bybit demonstrated that it could absorb a very large shock without freezing its customers out.
Absorbing the loss also turned the breach into the company's problem rather than its users' problem. For a customer, the difference between an exchange that is hacked and reimburses everyone and one that is hacked and cannot is far larger than the difference between an exchange that has been hacked and one that has not.
Scale made the response harder. A request count above 350,000 in three days means thousands of withdrawals per hour at a time when public attention was intense and confidence was fragile. Meeting that demand required liquidity, operational capacity and clear communication at once, three things that are difficult to improvise after an incident and easier to provide if they have been planned in advance.
4. What does a layered defence look like?
A layered defence combines several protections that do not all fail for the same reason. Bybit has described expanded security measures that include enhanced multi-signature wallets and monitoring assisted by artificial intelligence. Multi-signature wallets require several independent approvals before funds can move, so that compromising one person or one device is not enough.
Monitoring adds a different kind of layer. Instead of preventing a transaction, it looks for patterns that suggest something is wrong and raises an alert, or blocks the transfer, before the damage is complete. The two approaches complement one another, because approvals guard against a single point of compromise, while monitoring watches for the cases approvals miss.
Zhou has long held that exchanges are exposed by their design. In an earlier interview he described them as a single point of failure and as centralised web applications that face the same security problems as other websites. He recommended independent security audits, strict management processes and a zero-trust architecture, in which no device or user is trusted by default.
Zero trust and multiple layers share a premise: that any one barrier will eventually be crossed. Designing for that possibility changes the questions engineers ask. They stop asking how to make a wallet impossible to breach and start asking what an attacker can reach after a breach, how fast they can move, and how soon the company can detect and respond.
Layering also has costs. Every additional approval adds friction, and every monitoring rule risks flagging legitimate activity. Exchanges must balance protection against speed, because customers expect withdrawals and trades to be quick. The design challenge is to place friction where the risk is greatest, for example on the largest or least usual transfers, so that ordinary activity is not slowed.
5. Is security a yes-or-no question for users?
Zhou's view is that security is not binary. A platform cannot honestly promise that it will never be attacked, so users are better served by asking what would happen to their money if it were. Whether the exchange holds backing for customer balances, whether it can keep withdrawals running, and how it communicates during a crisis are all part of the answer.
This approach reflects how risk is assessed in other parts of finance. Banks are not judged on whether anyone has ever attempted to rob them, but on deposit protection, capital and the ability to keep operating. Applying a similar standard to crypto exchanges asks for evidence of resilience rather than assurances of perfection.
For customers, the practical consequence is a change in what to look for. Reserve practices, wallet architecture, the use of multiple approvals and the track record of handling past incidents all say more about an exchange than a clean history alone, which may simply reflect that an attack has not yet succeeded.
Another element of this view is honesty with customers. A company that admits attacks are possible can explain in advance what it has done to limit the consequences, whereas one that claims to be unbreakable has little to say when a breach occurs. Clear disclosure before and after an incident helps users make informed choices about where to keep their funds.
6. Why should the wider industry pay attention?
Supply-chain attacks such as the one that hit Bybit target infrastructure that many companies share. A flaw in one popular tool can expose several platforms simultaneously, which means that one exchange's security failure can become a warning for all of its competitors.
That shared exposure is an argument for cooperation. When exchanges publish what they learned from incidents, and when they confirm quickly and publicly whether they were affected by someone else's, other firms can check their own systems sooner. Zhou's call for a mindset of assumed attacks fits this approach, because a company that expects to be targeted is more likely to share information and prepare in advance.
The wider backdrop is a sector that has seen repeated, very large thefts, including the more recent theft at Binance. Each one strengthens the case that billion-dollar losses are a recurring feature of the industry and not a series of unrelated accidents, and that exchanges should plan accordingly.
Shared tooling also concentrates responsibility. Companies that use the same wallet software or the same service providers inherit each other's weaknesses, so due diligence on vendors becomes part of an exchange's own security. Reviewing the suppliers that sit between employees and their signing keys is as important as defending the exchange's own systems.
7. What should exchanges do next?
The direction of Zhou's argument points to a short list of priorities. Exchanges should assume that a breach will occur, separate their most valuable assets behind more than one independent approval, monitor continuously for unusual movement, and keep the financial strength to protect customers if something goes wrong.
None of these steps guarantees safety, and Zhou does not claim that they do. His claim is narrower and easier to defend: that a business designed to survive an attack is in a stronger position than one designed on the belief that no attack will come. Bybit's own record in 2025, in which customers were not left with losses and withdrawals kept flowing, is the example he offers in support.
Whether other operators adopt the same posture will become clearer as they publish their own security reviews after recent incidents. Readers can expect the debate over mandatory safeguards, transparency about reserves and expectations for incident response to continue as exchanges compete for the trust of users.
The most important test of any security programme is how it performs on the day something goes wrong. Drills, rehearsed communication plans and pre-arranged funding for emergencies shorten the time between detection and a stable response. Zhou's emphasis on survival, rather than on a flawless record, puts that preparation at the centre of what exchanges should be doing now.