Bybit Hack: Delving Into the Security Measures and Lessons Learned

Considering that the Bybit exchange hack worth $1.4B became the largest in history, it requires us to learn crucial lessons about the reliability of this platform and the security of the whole crypto industry.

Here, we will delve deeply into Bybit’s system security measures, as well as funds and customer protection, to better understand how one of the biggest crypto platforms with millions of users worldwide became a victim of a successful cyber attack.

Was Bybit Hacked?

First things first, and let’s get a clear definition of “hack” and determine whether Bybit hacked. Hack means that some system has a vulnerability, and bad actors explored and exploited it earlier than the security team could fix it.

Thus, from a purely technical standpoint, a system can be considered hacked if:It has a known or zero-day vulnerability that was exploited by an attacker.The attacker gained unauthorized access to the system's internals or data.

Let’s evaluate this from a technical perspective, with the recent research from two cybersecurity firms, Verichains and Sygnia Labs, being particularly helpful. Specifically, Verichains’ report clarifies that the issue was not on Bybit’s side but rather in the multi-sign service Safe:Proxy wallet management compromiseSpoofs the logic of the proxy contractFunds withdrawal

Does This Mean That Bybit Was Not Hacked?

First, let’s answer another question: Can a hack only occur due to technical reasons? Not really, because today’s systems are mostly too complex, meaning an attacker must develop a sophisticated attack that includes both technical vulnerabilities in the target system or its integrations, as well as social engineering, where the targets are internal staff, vendors, etc.

Therefore, dividing attack tactics and scenarios into technical and non-technical categories does not provide a clear-cut definition, and it’s better to assess it based on the outcome.

One of the classic and precise ways to evaluate this is the CIA triad, which states that a system should be designed to ensure that its information maintains three key principles: Confidentiality, Integrity, and Availability.

Confidentiality – Not Compromised Overall

Integrity – Compromised, But Not in Bybit’s Infrastructure

Availability – Not Compromised Overall

After reviewing this situation from multiple perspectives, we can conclude that, strictly speaking, Bybit was not hacked, but it was subjected to a sophisticated and successful attack by the Lazarus Group, as discovered ZachXBT. Although the investigation is still ongoing, the latest reports indicate that Bybit’s systems, infrastructure, and data were not compromised, further confirming my initial assumption.

Bybit Security Measures

Let’s use an analogy: suppose a criminal decides to rob a bank. If the bank lacks proper security, they can simply walk in, make threats, and leave with the stolen money. However, with many cameras and guards, the attacker will be forced to look for alternative ways to carry out the heist—otherwise, the risk would be too high.

Now, this leads us to the logical conclusion that since the attackers chose not to conduct a direct attack but instead carried out a more complex and costly operation, it indicates that Bybit is well-protected against direct intrusions.

Let’s look at the specific security mechanisms and protective measures Bybit has in place, which forced the attackers to compromise intermediaries rather than the platform itself.

Asset Protection: Cold Wallets and Cryptographic Security

Bybit places significant emphasis on the secure storage of assets, and ironically, this was not enough to prevent the incident. Specifically, they store the majority of funds in cold wallets, withdrawing a portion every three weeks to facilitate user withdrawals and other platform operations. In this context, they implement a triple-layer security system:Multi-Signature Authentication – Requiring multiple independent signatures for withdrawals from cold wallets, preventing unauthorized access.Trusted Execution Environment (TEE) – A secure execution environment that protects critical operations from external attacks.Threshold Signature Schemes (TSS) – Distributing signing authority among multiple independent participants to eliminate single points of failure.

However, as we now know, the third-party Multi-Signature Authentication service turned out to be one of the weak points. Yet, everything under Bybit’s direct control remained secure—otherwise, we would have seen all of the exchange’s funds be stored in hot wallets, exposed to direct attacks, and putting not just some wallets but the entire platform at risk.

Real-Time Transaction Monitoring and Control

As a part of its risk control system, Bybit implements continuous analysis of user activity and transactions.

User Behavior Analysis – The exchange detects and analyzes suspicious activities such as logins from new devices, abnormal transaction volumes, or IP address changes.Automated Authentication Enhancement – If the system detects deviations from normal behavior, such as an attempt to withdraw large amounts of funds, the user will be required to undergo additional identity verification.Notification and Logging System – Any changes to the account, login attempts, API key modifications, or large withdrawals are instantly recorded and reported to