More than a year after losing roughly $1.46 billion in one of cryptocurrency’s largest security breaches, Bybit is rebuilding its defense strategy around speed: detecting suspicious behavior earlier, monitoring blockchain activity continuously and using AI to accelerate security operations without removing humans from critical decisions.

Bybit’s latest security report offers a look at how a major cryptocurrency exchange is attempting to change its security posture after the February 2025 breach, when attackers stole approximately $1.46 billion in digital assets.

In its first-half 2026 Risk & Security Report, covering January 1 through June 15, the exchange describes a three-layer security architecture spanning account protection, real-time on-chain monitoring and AI-assisted security operations.

The shift is significant because the crypto industry’s security problem is no longer limited to protecting wallets or smart contracts. Centralized exchanges operate across identity systems, withdrawal infrastructure, blockchain networks, custody systems, APIs and third-party integrations. A vulnerability in any one layer can create an outsized financial consequence.

Chainalysis described the 2025 Bybit incident as the largest digital heist in cryptocurrency history, with attackers moving roughly $1.5 billion in Ether after compromising the signing workflow used for a wallet transaction.

Bybit’s response is increasingly focused on reducing the amount of time between a suspicious event and intervention.

During the first half of 2026, the company says it intercepted more than 30,000 suspicious withdrawal requests and protected nearly 20,000 users from more than $700 million in potential losses. The average initial risk review took 4.7 minutes, with 95% completed within 10 minutes.

Those numbers are self-reported and should not be interpreted as an independent measure of Bybit’s security performance. But they illustrate the operational model the exchange is pursuing: automated systems identify potentially dangerous activity, while security specialists make decisions on complex cases.

Moving security beyond the exchange

One of the more consequential changes is Bybit’s expansion of on-chain monitoring.

The exchange says it now covers 100% of business-relevant on-chain activity, including listed token contracts and its cold, warm and hot wallets. During H1 2026, it identified approximately $212 million in potentially fraud-linked on-chain funds and blacklisted more than 10,000 malicious addresses.

The approach reflects an important characteristic of blockchain security: the public ledger can become a defensive data source as well as a target.

Transaction histories, wallet behavior and token movements can provide signals that traditional cybersecurity systems cannot see. Blockchain intelligence firms such as Chainalysis have similarly emphasized the importance of real-time transaction monitoring and cross-industry coordination in tracing stolen assets. In the aftermath of the Bybit attack, blockchain analysis helped authorities identify and freeze some stolen funds.

Bybit says its monitoring also helped it handle 10 security incidents involving listed token projects during the first half of 2026, with no platform losses. In eight cases, the company says it responded before other major exchanges, while two incidents were identified before the affected projects discovered the attacks.

That represents a move from exchange security toward ecosystem security.

For crypto platforms, a compromised token project, smart contract or external wallet can create downstream risks even when the exchange itself has not been directly breached. Monitoring the surrounding blockchain environment therefore becomes part of protecting customers and liquidity.

AI becomes a force multiplier

AI is another major component of Bybit’s security strategy.

The company says more than 100,000 security alerts were processed with AI-assisted analysis during H1 2026. Its AI-assisted security auditing reportedly identified high-severity vulnerabilities at three to five times the rate of manual review.

Automation also reduced the time between security assessment and testing from roughly two weeks to two hours, according to Bybit.

Its automated red-team platform assessed 1,489 public-facing assets and identified more than 100 high-severity vulnerabilities. The average time from asset discovery to initial penetration testing fell below 24 hours, compared with a traditional process measured in weeks.

The important distinction is that Bybit is not presenting AI as a replacement for security professionals. Instead, it is using AI to increase the volume and speed of analysis while keeping human judgment in critical decisions.

That mirrors a broader shift across cybersecurity. Attackers can automate reconnaissance, vulnerability discovery and social engineering, meaning defensive teams increasingly need automation simply to keep pace.

Chainalysis has identified the growing use of AI-driven scams and increasingly complex on-chain obfuscation as reasons for exchanges and blockchain businesses to adopt more proactive security capabilities.

The threat landscape remains severe

The need for faster defenses is underscored by the wider Web3 security environment.

CertiK reported more than $1.31 billion in cryptocurrency losses across 344 security incidents during the first half of 2026. Excluding the extraordinary impact of the 2025 Bybit breach, CertiK said H1 2026 losses were approximately 28% higher on a comparable basis. Wallet compromises were the largest financial attack category, accounting for more than $444 million across 33 incidents.

Chainalysis’ 2026 Crypto Crime Report also found that DPRK-linked hackers stole approximately $2 billion in cryptocurrency during 2025, with the Bybit attack accounting for nearly $1.5 billion.

That backdrop changes the economics of exchange security. A platform can invest heavily in cold storage and still be vulnerable through signing workflows, employee accounts, third-party software or operational processes.

Bybit’s new architecture therefore emphasizes multiple defensive layers rather than a single security control.

From technical defense to financial crime coordination

The company’s security strategy also extends beyond its own infrastructure.

Bybit says it has worked with law enforcement, blockchain intelligence companies and industry partners to trace and recover stolen assets. It has also pursued legal action related to the February 2025 attack and attributed the incident to the Lazarus Group.

The broader principle is increasingly important for digital asset businesses: blockchain security cannot be treated solely as an internal IT problem.

Stolen assets can move across exchanges, bridges, decentralized applications and jurisdictions within minutes. Effective response therefore depends on cooperation among trading platforms, blockchain analytics providers, cybersecurity teams and government agencies.

What it means for crypto platforms

Bybit’s H1 report points toward a security model that looks increasingly like continuous financial infrastructure monitoring rather than periodic cybersecurity assessment.

For exchanges and institutional digital-asset platforms, the priorities are becoming clear: real-time transaction intelligence, automated alert triage, continuous penetration testing, identity protection and rapid coordination when an incident crosses organizational boundaries.

AI can improve the speed and scale of that defense, but it does not eliminate the underlying governance problem. The more authority an automated system receives, the more important model controls, auditability and human escalation become.

Bybit’s post-breach strategy is ultimately a bet on shortening the defensive cycle. Attackers may use AI to find weaknesses faster, but exchanges can use similar technology to detect, investigate and respond before an exploit becomes a balance-sheet event.

The measure of success will not be the number of alerts an AI system can process. It will be whether those systems consistently stop high-value attacks before customers and platforms absorb the loss.

Market Landscape

Crypto security is moving toward continuous detection and response, with centralized exchanges increasingly combining traditional cybersecurity, blockchain analytics, fraud detection and automated threat intelligence.

The shift is occurring because attack patterns are becoming more concentrated and financially severe. CertiK’s H1 2026 data shows that more than $1.31 billion was lost across 344 incidents, while Chainalysis reported that crypto theft exceeded $3.4 billion during 2025, with the Bybit attack accounting for approximately $1.5 billion.

The competitive landscape now includes exchanges such as Bybit, Coinbase and Binance, specialist blockchain intelligence providers such as Chainalysis, and cybersecurity companies developing real-time on-chain threat detection.

For enterprise crypto platforms, the distinction between cybersecurity and financial crime prevention is increasingly disappearing. A suspicious login, compromised signing process or malicious smart contract can rapidly become a financial event.

That makes real-time monitoring, automated investigation and cross-platform intelligence increasingly important infrastructure for digital asset businesses.

Top Insights

• Bybit’s post-breach strategy combines account security, on-chain monitoring and AI-assisted operations to reduce detection and response times across its crypto infrastructure.
• The exchange says it intercepted more than $700 million in potential user losses during H1 2026, underscoring the value of rapid withdrawal-risk intervention.
• AI processed more than 100,000 security alerts while accelerating vulnerability testing, allowing security teams to examine more assets without eliminating human oversight.
• Bybit’s 100% business-relevant on-chain monitoring expands exchange security beyond internal systems into token contracts, wallets and surrounding blockchain activity.
• The wider market remains exposed, with CertiK recording more than $1.31 billion in Web3 security losses across 344 H1 2026 incidents.

Get in touch with our fintech expert