Bybit strengthens security defenses in response to evolving cryptocurrency threats, successfully int

Bybit Security Report for the First Half of 2026: Strengthen account protection, 100% on-chain monitoring and AI-assisted threat detection

Bybit, the world's second-largest cryptocurrency exchange by transaction volume, has comprehensively strengthened and expanded its security system after the theft of approximately US$1.46 billion in digital assets in February 2025, shifting to a defense model that aims to detect threats earlier, respond faster, and continue to adapt to new technologies for attackers, including the use of artificial intelligence.

In the "Risk and Security Report for the First Half of 2026" covering the period from January 1 to June 15, 2026, Bybit elaborated on three layers of protection mechanisms: user and account security, real-time on-chain monitoring and AI-assisted security operations. The goal is not simply to add control measures, but to build a security system that can continue to learn from emerging threats and shorten the time between detection and intervention.

"The arms race for cybersecurity has entered the minute-level era. Using AI to strengthen our security and risk control capabilities, while ensuring the security of the AI system itself, is our current top priority; and key security decisions still need to be based on manual judgment." David Zong, head of risk control and security at Bybit Group, said.

From incident response to all-weather defense

Advanced attackers often exploit cross-cutting vulnerabilities between technology, human behavior, and operational processes. Faced with ongoing security challenges, Bybit continues to expand its security architecture to cover account protection, on-chain monitoring, fraud detection, security testing and incident response. In the first half of 2026, Bybit intercepted more than 30,000 suspicious withdrawal requests, protected nearly 20,000 users, and avoided potential losses of more than US$700 million. The average preliminary review takes 4.7 minutes, and 95% of reviews are completed in 10 minutes. At the same time, through on-chain behavioral analysis and AI-assisted monitoring, the company identified approximately US$212 million in suspected fraudulent on-chain funds and blacklisted more than 10,000 malicious addresses to identify emerging fraud patterns.

Monitoring the dual dimensions of blockchain and platform

Bybit has expanded its monitoring scope to 100% of business-related on-chain activities, including listed token contracts, ecological contracts, and the company's cold, warm and hot wallets. In the first half of 2026, Bybit discovered and handled 10 security incidents involving listed token projects, and the platform suffered no losses. In eight of these incidents, Bybit completed the Incident Response Service before the major exchanges; in two other incidents, they were detected before the affected project parties themselves discovered the attack.

AI shortens defense cycle

As attackers use automation and AI to accelerate reconnaissance and vulnerability discovery, Bybit applies AI to security operations, Code Audit and penetration testing. In the first half of the year, the system processed more than 100,000 security alerts through AI-assisted analysis. AI-assisted security audits are 3 to 5 times more efficient than manual reviews in identifying high-risk vulnerabilities. At the same time, automation has shortened the time from security assessment to testing from about two weeks to two hours, allowing Bybit to discover and investigate potential vulnerabilities faster. Its automated red team platform evaluated 1489 publicly facing assets and identified more than 100 high-risk vulnerabilities. The average time from asset discovery to initial penetration testing has been reduced to less than 24 hours, while traditional manual cycles typically take weeks. AI is mainly used to increase the scale and speed of detection and testing, and complex threat decisions are still the responsibility of human security experts.

Global accountability makes attackers pay

Bybit's actions go beyond technical levels. It works with law enforcement agencies, blockchain intelligence companies and industry partners to track and recover stolen assets, and has filed legal proceedings against North Korea and the Lazarus Group to hold accountable and recover assets related to the attack. For Bybit, the broader security goal is to make attacks more difficult to implement and less profitable, which requires not only strengthening its own platform, but also improving coordination capabilities between exchanges, blockchain networks, investigative agencies and law enforcement agencies.

Security is a continuous process

The first half of 2026 security report is a reflection of Bybit's commitment to transparency and is also a reflection of <｜image｜>A chapter in security evolution. As attackers adopt new methods and tools with the help of increasingly popular AI technology, Bybit's defense system is also evolving simultaneously.