Bybit’s H1 2026 report details expanded account protection, 100% on-chain monitoring and AI-assisted threat detection following 2025 security incident

Bybit, the world’s second-largest cryptocurrency exchange by trading volume, has strengthened and expanded its security systems following the February 2025 theft of approximately $1.46 billion in digital assets, moving toward a model designed to detect threats earlier, respond faster and continuously adapt as attackers adopt new techniques, including artificial intelligence.

In its H1 2026 Risk & Security Report, covering January 1 through June 15, Bybit details the operation of three layers of protection: user and account security, real-time on-chain monitoring, and AI-assisted security operations.

The objective is not simply to add more controls, but to create a security system that can continuously learn from emerging threats and reduce the time between detection and intervention.

Bybit Security at a Glance

““The cybersecurity arms race has entered an era of minutes. Using AI to strengthen our security and risk-control capabilities, while securing the AI systems themselves, is our top priority, with human judgement remaining at the centre of critical security decisions,” said David Zong, Head of Group Risk Control and Security at Bybit.

From incident response to always-on defence

Sophisticated attackers can exploit weaknesses at the intersection of technology, human behaviour and operational processes.

In view of the ongoing security challenges, Bybit has been expanding its security architecture across account protection, on-chain monitoring, fraud detection, security testing and incident response.

In H1 2026, Bybit intercepted more than 30,000 suspicious withdrawal requests, protecting nearly 20,000 users from more than $700 million in potential losses. The average initial review took 4.7 minutes, with 95% completed within 10 minutes.

The company also identified approximately $212 million in potential fraud-linked onchain funds and blacklisted more than 10,000 malicious addresses, using on-chain behavioural analysis and AI-assisted monitoring to identify emerging fraud patterns.

Watching the blockchain as well as the platform

Bybit has expanded monitoring to 100% of business-relevant on-chain activity, including listed token contracts, ecosystem contracts and the company's cold, warm and hot wallets.

During the first half of 2026, Bybit identified and handled 10 security incidents involving listed token projects, with zero resulting losses to the platform. In eight cases, Bybit completed relevant emergency responses before other major exchanges, while two incidents were detected before the affected projects themselves identified the attacks.

AI is shortening the defensive cycle

As attackers use automation and AI to accelerate reconnaissance and vulnerability discovery, Bybit is applying AI across security operations, code auditing and penetration testing.

More than 100,000 security alerts were processed with AI-assisted analysis during H1. Bybit’s AI-assisted security auditing identified high-severity vulnerabilities at 3–5 times the rate of manual review. At the same time, automation reduced the time required to move from security assessment to testing from approximately two weeks to two hours, enabling Bybit to identify and investigate potential vulnerabilities at a substantially faster pace.

Its automated red-team platform assessed 1,489 public-facing assets and identified more than 100 high-severity vulnerabilities. The average time from asset discovery to initial penetration testing was reduced to under 24 hours, compared with a traditional manual cycle measured in weeks.

AI is being used primarily to increase the scale and speed of detection and testing, while human security specialists remain responsible for complex threat decisions.

A global fight to hold attackers accountable

Bybit  has also extended beyond technical controls. It  has worked with law enforcement, blockchain intelligence firms and industry partners to trace and recover stolen assets. It has also pursued legal action against North Korea and the Lazarus Group, seeking accountability and recovery of assets connected to the attack.

For Bybit, the broader security objective is to make attacks harder to execute and less profitable. This means not only strengthening the platform itself, but improving coordination across exchanges, blockchain networks, investigators and law enforcement.

Security is an ongoing process

The 2026 H1 Security report is a testament to Bybit’s transparency pledge, and marks a chapter in Bybit’s security evolution.  As attackers adopt new technologies and methods, increasingly aided by the growing prevalence of AI, Bybit’s defensive systems are engineered to evolve in kind.

The detailed security architecture, methodologies and supporting metrics are available in the H1 2026 Risk & Security Report.

Disclaimer:

Unless otherwise stated, figures cover January 1 through June 15, 2026 and are based on Bybit's internal security, risk and engineering systems. The metrics are self-reported by Bybit and are intended to provide transparency into its security operations. They should not be interpreted as a guarantee of future security performance or as a comparative ranking of exchanges.

#NewFinancialPlatform

//ENDS