A major cryptocurrency exchange blocked more than $700 million in potential user losses during the first half of 2026, deploying AI-assisted monitoring and behavioral analysis to intercept suspicious withdrawals before funds left the platform, according to a newly released security report.
Bybit's H1 2026 Risk and Security Report, covering January 1 through June 15, reveals the most detailed picture yet of how the exchange has rebuilt its defenses following the February 2025 breach that drained approximately $1.46 billion in Ethereum from its cold wallet, the largest cryptocurrency theft on record.
The Numbers Behind the Defense Buildout
Bybit intercepted more than 30,000 suspicious withdrawal requests in the first half of 2026, protecting nearly 20,000 users from losses that could have exceeded $700 million. Initial risk reviews averaged 4.7 minutes to complete, with 95% wrapped up within 10 minutes. The exchange credits this speed to behavioral analysis paired with AI-supported monitoring designed to identify new fraud patterns as they emerge.
On the blockchain side, security teams identified roughly $212 million in funds potentially connected to fraud and added more than 10,000 malicious addresses to Bybit's blacklist. The monitoring system covers 100% of on-chain activity the exchange considers relevant, including listed token contracts, ecosystem contracts, and its cold, warm, and hot wallets. During the first half of the year, the system identified and handled 10 security incidents affecting token projects listed on Bybit, with none resulting in losses to the exchange.
AI as a Security Multiplier
Artificial intelligence has taken on a central role in Bybit's rebuilt security model. AI-assisted analysis processed over 100,000 security alerts during the period, and AI-supported audits identified high-severity vulnerabilities at rates three to five times higher than traditional manual approaches. Automated systems cut the gap between a security assessment and follow-up testing from approximately two weeks down to roughly two hours.
An automated red-team platform assessed 1,489 public-facing assets and flagged more than 100 high-severity vulnerabilities. The average time between discovering an asset and beginning penetration testing fell below 24 hours, compared to manual processes that could stretch for weeks. The exchange described the approach as a three-layer defense system combining user account controls, continuous on-chain monitoring, and AI-supported security operations, with human specialists retaining final authority over critical decisions.
The Shadow of the $1.46 Billion Hack
Bybit's current security infrastructure exists because of a breach that redefined the scale of cryptocurrency theft. On February 21, 2025, attackers compromised the process used to move funds from Bybit's Ethereum cold wallet, draining approximately 400,000 ETH alongside staked Ether valued at roughly $1.46 billion. U.S. authorities attributed the attack to North Korea's Lazarus Group.
CEO Ben Zhou said at the time the exchange could absorb the loss and continue processing withdrawals, covering the shortfall through Ether purchases, loans, and counterparty deposits. The exchange has since filed a lawsuit in the U.S. District Court for the District of Columbia against North Korea, its Reconnaissance General Bureau, and the Lazarus Group. For more on crypto security developments, see our coverage of Lightning Network exploits.
What This Means for Exchange Security
The report arrives amid a broader industry conversation about exchange security following multiple high-profile incidents. North Korean-linked actors obtained approximately $2.02 billion in cryptocurrency in 2025, with the Bybit incident representing the majority. Two additional Lazarus-linked attacks against DriftProtocol and KelpDAO in April 2026 reportedly drained a combined $577 million using social engineering and compromised devices rather than conventional smart contract exploits.
The shift toward human and infrastructure vulnerabilities suggests that exchanges can no longer rely solely on code-level security audits. The attack surface now includes signers, devices, and the people operating them. Bybit's investment in AI-driven defense represents one approach to closing the gap between detecting a threat and acting on it, but the effectiveness of these systems against increasingly sophisticated social engineering attacks remains an open question. For more on crypto security, read our coverage of Decred's critical security patch.
For the latest crypto security news, visit Bitnxt.
