Crypto exchange Bybit says its security systems prevented more than $700 million in potential user losses during the first half of 2026, highlighting the growing role of automated monitoring and artificial intelligence as exchanges contend with increasingly sophisticated attacks.
According to a risk and security report released August 18, Bybit blocked more than 30,000 suspicious withdrawal requests between January 1 and June 15, protecting nearly 20,000 users. The company characterized the $700 million as potential losses intercepted by its controls rather than funds stolen and subsequently recovered.
The figure represents a substantial increase from 2025, when Bybit said its AI-driven risk framework prevented approximately $300 million in potential losses over Q4 of 2025 for roughly 4,000 users. During the whole of 2025, the exchange also reported blocking about 3 million credential-stuffing attempts.
Bybit cautioned that its latest statistics should not be interpreted as a guarantee of future security performance or as a direct comparison with other cryptocurrency exchanges.
AI Compresses Security Response From Weeks to Hours
A major focus of Bybit’s latest security strategy is using artificial intelligence to accelerate vulnerability discovery while retaining human oversight for critical decisions.
The exchange said AI-assisted auditing identified high-severity vulnerabilities at three to five times the rate of manual reviews. Automation also reduced the period between security assessment and testing from approximately two weeks to about two hours.
Bybit’s automated red-team platform assessed 1,489 public-facing assets and identified more than 100 high-severity vulnerabilities. The time between discovering an issue and beginning the first penetration test was reduced to less than 24 hours.
More than 100,000 security alerts were processed with AI assistance during the period. Bybit said its monitoring now covers 100% of business-relevant on-chain activity, including listed-token contracts and assets held across cold, warm and hot wallets.
Initial risk reviews averaged 4.7 minutes, with 95% completed within 10 minutes. The exchange also reported responding to 10 incidents involving listed-token projects without sustaining platform losses, including detecting two incidents before the affected projects themselves.
Security Push Follows Bybit’s $1.46 Billion Hack
The investment comes against the backdrop of Bybit’s February 2025 breach, one of the largest cryptocurrency thefts on record. Attackers compromised the exchange’s cold-wallet signing process and stole approximately $1.46 billion, according to Bybit’s accounting.
The FBI attributed the attack to North Korea, identifying the responsible actors as TraderTraitor, which U.S. authorities associate with the Lazarus Group.
Bybit has continued pursuing recovery efforts. Earlier in August, the exchange announced that it had secured a preliminary U.S. court injunction targeting North Korea, the Lazarus Group and associated actors. Bybit says approximately $48.4 million has been recovered and more than $30.5 million frozen across over 28 exchanges and custodians.
The broader threat environment remains substantial. Blockaid estimated that approximately $1.1 billion was stolen across 212 crypto security incidents during the first half of 2026.
For centralized exchanges, the shift toward AI-assisted monitoring reflects the shrinking response window created by blockchain transactions that can move stolen assets globally within minutes.
Bybit’s $700 million figure therefore measures prevented exposure rather than realized savings independently verified on-chain. Even so, the jump from roughly $300 million during all of 2025 indicates the scale at which the exchange says suspicious withdrawal activity is now being detected before assets leave its control.
