In response to the theft of approximately $1.46 billion in digital assets that occurred in February 2025, Bybit, the world’s second-largest cryptocurrency exchange by trading volume, has strengthened and expanded its security systems. Bybit is moving toward a model that is designed to detect threats earlier, respond faster, and continuously adapt as attackers adopt new techniques, including artificial intelligence.
The Bybit H1 2026 Risk & Security Report, which covers the period from January 1 to June 15, provides information about the operation of three levels of protection. These layers include user and account security, real-time on-chain monitoring, and security activities that are helped by artificial intelligence.
The goal is not only to increase the number of controls; rather, it is to develop a security system that is capable of continually learning from new threats and reducing the amount of time that passes between detection and action is the target.
Measure and H1 2026 Result
““The cybersecurity arms race has entered an era of minutes. Using AI to strengthen our security and risk-control capabilities, while securing the AI systems themselves, is our top priority, with human judgement remaining at the centre of critical security decisions,” said David Zong, Head of Group Risk Control and Security at Bybit.
Hackers with a high level of sophistication are able to take advantage of vulnerabilities that exist at the confluence of technology, human behavior, and operational procedures.
Bybit has been developing its security architecture to include areas such as account protection, on-chain monitoring, fraud detection, security testing, and incident response in response to the continuous security issues.
In the first half of 2026, Bybit was able to prevent more than 30,000 suspicious withdrawal requests from being processed, therefore shielding almost 20,000 users from possible losses of more than 700 million dollars. In the first review, the average time was 4.7 minutes, and 95% of the reviews were finished within 10 minutes.
Using on-chain behavioral analysis and AI-assisted surveillance, the business was able to uncover growing fraud trends and blacklist more than 10,000 bad addresses. Additionally, the company discovered around $212 million in potential onchain assets that were related to fraudulent activity inside the blockchain.
Through this expansion, Bybit is now monitoring one hundred percent of all business-related on-chain activity. This includes listed token contracts, ecosystem contracts, and the cold, warm, and hot wallets that the firm maintains.
For the first half of the year 2026, Bybit discovered and resolved ten security problems that included listed token projects. As a result, the platform did not suffer any damages as a consequence of these occurrences. There were eight instances in which Bybit finished important emergency replies before other big exchanges, and there were two events that were discovered before the impacted projects themselves recognized the assaults.
AI is being used throughout Bybit’s security operations, code auditing, and penetration testing in response to the fact that attackers are using automation and AI to speed up the process of discovering vulnerabilities and conducting reconnaissance.
During the first half of the year, more than one hundred thousand security warnings were analyzed with the assistance of artificial intelligence. High-severity vulnerabilities were discovered by Bybit’s AI-assisted security auditing at a pace that was three to five times faster than that of human inspection. Additionally, the time necessary to go from security assessment to testing was lowered from around two weeks to two hours as a result of automation. This made it possible for Bybit to discover and explore potential vulnerabilities at a much quicker pace.
Its automated red-team platform conducted an assessment of 1,489 assets that were exposed to the public and discovered more than one hundred vulnerabilities of high severity. When compared to a standard manual cycle that is measured in weeks, the average amount of time that passed between the identification of assets and the first penetration testing was cut down to less than twenty-four hours.
It is largely for the purpose of increasing the size and speed of detection and testing that artificial intelligence is being used, while human security professionals continue to be responsible for making complicated threat determinations.
Additionally, Bybit has expanded outside the realm of technological controls. On behalf of law enforcement, blockchain intelligence businesses, and industry partners, it has collaborated in order to track down and retrieve assets that have been stolen. In addition to this, it has taken legal action against North Korea and the Lazarus Group, with the goal of obtaining responsibility and recovering assets that are associated with the assault.
When it comes to Bybit’s security, the overarching goal is to make it more difficult to carry out attacks and less lucrative to do so. By doing so, not only will the platform itself be strengthened, but also the cooperation between exchanges, blockchain networks, investigators, and law enforcement will be improved.
The Bybit 2026 H1 Security Report is a landmark to the company’s commitment to openness, and it represents a chapter in the growth of Bybit’s security offerings. The defensive systems of Bybit are designed to adapt in tandem with the new technologies and approaches that attackers are adopting, which are being made possible by the rising prominence of artificial intelligence.
The H1 2026 Risk & Security Report encompasses the comprehensive security architecture, procedures, and metrics that provide support for the security architecture.
Disclaimer:
Unless otherwise stated, figures cover January 1 through June 15, 2026 and are based on Bybit’s internal security, risk and engineering systems. The metrics are self-reported by Bybit and are intended to provide transparency into its security operations. They should not be interpreted as a guarantee of future security performance or as a comparative ranking of exchanges.
