Bybit review: is it safe after the 2025 hack, and worth the risk?
We traded spot and perpetuals on Bybit, checked how the exchange covered a $1.46 billion hack in February 2025, and weighed its recovery record against its fees before scoring it for an active trader.
Our verdict
Bybit's response to the February 2025 hack was fast and largely transparent: leadership recapitalized the reserve from its own balance sheet, loans and counterparties within roughly 72 hours, and kept processing withdrawals throughout, with 99.994% of 350,000 requests cleared inside 10 hours. That response does not undo the fact that attackers took 1.46 billion dollars through a compromised signing process, and a trader weighing Bybit against Kraken or Coinbase should treat the hack as a real mark against its security posture, not a settled matter, even with reserves now reported above 100%.
Best for: Active derivatives traders who accept the 2025 hack risk in exchange for deep tools
Bybit's history now splits cleanly into before and after February 21, 2025. We traded spot and perpetual futures on the exchange, dug into how the exchange handled the hack that day, and weighed the fee structure and recovery record against what a trader gives up by choosing Kraken or Coinbase instead.
What actually happened on February 21, 2025
Attackers stole approximately 1.46 billion dollars during a routine cold-to-warm wallet transfer: roughly 401,347 ETH plus staked derivatives including stETH, cmETH and mETH. The method was not a brute-force break-in; it exploited compromised Safe-related infrastructure and malicious JavaScript that manipulated what Bybit's signers saw on screen during approval. US authorities later attributed the attack to North Korea's Lazarus Group, tracked under the TraderTraitor designation, the same actors behind several of the largest crypto thefts on record.
The recovery was fast, and that matters, but it is not the whole story
Bybit did not pause withdrawals to sort out the damage. Leadership sourced ETH from the company's own balance sheet, short-term loans and external counterparties, restoring full reserve coverage within roughly 72 hours of the theft. Through the crisis the exchange processed about 350,000 withdrawal requests, with 99.994 percent clearing inside 10 hours, a detail that separates this response from exchanges that have frozen withdrawals during past incidents and left users waiting weeks for an update.
