Bybit Says AI Helped Recover $700M a Year After $1.46B Loss

The cryptocurrency exchange that suffered a $1.46 billion loss in a North Korea-linked hack has become the first major centralized platform to provide concrete figures supporting a claim Bitcoin developers have emphasized throughout the month: AI can significantly improve cybersecurity.

Bybit said its AI-powered security audits identified serious vulnerabilities at up to five times the rate achieved through conventional manual reviews. The technology also reduced the time needed to move from evaluating a system to actually testing it, cutting the process from roughly two weeks to only two hours.

From Jan. 1 through June 15, Bybit said its AI systems blocked more than 30,000 suspicious withdrawal attempts and potentially protected nearly 20,000 customers from losses exceeding $700 million. According to a company release shared with CoinDesk, the initial review of a flagged withdrawal took an average of 4.7 minutes.

The exchange has a clear reason for highlighting these results. In February 2025, Bybit suffered a theft of approximately $1.46 billion, the largest hack in crypto history, which was attributed to North Korea’s Lazarus Group. The company is now taking legal action against both the North Korean state and the group.

However, Bybit’s figure represents potential losses that it says were prevented, rather than confirmed thefts that were already in progress. The exchange also reported that its AI systems identified roughly $212 million in funds associated with suspected fraud and placed more than 10,000 addresses on its blacklist. These figures have not been independently verified.

AI Expands Bybit’s Security Operations

Bybit’s automated red-team technology scanned 1,489 internet-facing assets during the period and uncovered more than 100 high-severity vulnerabilities. The company said the time required to move from discovering an asset to testing it dropped to less than 24 hours.

AI-assisted systems also helped process more than 100,000 security alerts during the same period, allowing Bybit to handle potential threats at a much larger scale.

The results come as smaller crypto companies and independent developers increasingly use AI tools to identify security weaknesses before hackers can exploit them.

BTCPay Server, which was recently targeted in an attack that drained merchant Lightning nodes, has argued that AI is shifting the cybersecurity balance. AI models can scan large amounts of code faster and at a lower cost, while attackers—particularly state-backed groups—may have access to significantly greater financial resources.

Crypto Industry Pushes for Better AI Security Tools

Last week, dozens of crypto-focused companies, including Coinbase and Block, signed an open letter calling on AI companies to provide defenders with early access to their most powerful models.

The groups argued that security researchers and developers are often forced to work with less capable AI systems than those potentially available to attackers.

At the same time, a volunteer initiative known as the Bitcoin Red Team has spent the month using AI models to examine Bitcoin-related codebases. The group has submitted thousands of findings covering hundreds of projects, including research that helped BTCPay identify and fix a vulnerability.

Unlike Bybit, which has developed its own AI security infrastructure, the Bitcoin Red Team relies on donated computing resources and sponsored accounts. The open letter similarly reflects developers seeking access to advanced models they may not otherwise be able to afford.

Bybit’s data therefore provides an early indication of what a well-funded organization can achieve by integrating AI directly into its cybersecurity operations.

“Cybersecurity has entered an era measured in minutes,” said David Zong, Bybit’s head of group risk control and security.

Zong added that strengthening security and risk controls with AI, while also protecting the AI systems themselves, remains a top priority, with human oversight continuing to play a central role in critical security decisions.

About The Author

ctleditor

See author's posts