The Bybit Hack Made Kim Jong Un Crypto’s Most Influential in 2025

Cryptocurrency alternate Bybit suffered a $1.4 billion hack in February 2025 that uncovered structural weaknesses in custody programs lengthy thought-about {industry} requirements, reminiscent of chilly storage and multisignature wallets.

On the time, the exploit was the most important recognized hack in crypto historical past, although that distinction was later eclipsed by findings that Chinese language mining pool LuBian misplaced $3.5 billion in 2020.

“The [Bybit] hack confirmed that chilly storage and multisig labels are meaningless if the approval stream, transaction visibility, or signer surroundings might be manipulated,” mentioned Ishai Shoham, head of product at crypto infrastructure firm Utila. “After Bybit, custody structure grew to become a first-order danger subject, not a back-office element.”

The incident additionally prompted the Monetary Motion Job Drive (FATF) to induce world regulators to handle illicit finance dangers in cryptocurrencies, whereas exchanges tightened transaction approval processes and raised the usual for a way breaches are detected and dealt with.

Non-public key hacks are liable for massive losses for centralized providers. Supply: Chainalysis

What’s FATF and why does it matter?

The FATF is an intergovernmental physique that units requirements on cash laundering and terrorist financing. Its suggestions should not legally binding, however its members are anticipated to abide by its requirements. For non-members that fall brief, inclusion on the FATF grey listing may restrict entry to help and injury banking relationships.

In a June 2025 report, the FATF cited the Bybit hack as the most important crypto theft ever. It warned that crosschain exercise, stablecoins and uneven world enforcement had been amplifying illicit finance dangers sooner than present controls may comprise them.

FATF referred to as on jurisdictions to tighten licensing and assess dangers related to abroad exchanges. Supply: FATF

“The case highlights persistent gaps in the Journey Rule and in enforcement. As soon as funds transfer into DeFi, it turns into troublesome to stop layering and cash laundering, notably as automation instruments make these processes sooner and simpler,” Joshua Chu, asset restoration lawyer and co-chair of the Hong Kong Web3 Affiliation, advised Cointelegraph.

Associated: From Sony to Bybit: How Lazarus Group became crypto’s supervillain

FATF urged jurisdictions to speed up licensing, supervision and worldwide coordination, framing the incident as proof that weaknesses in custody and transaction oversight now pose systemic dangers to the worldwide monetary system. Just like the US Federal Bureau of Investigation and countless security experts, FATF linked the exploit to hackers tied to North Korea.

Blockchain sleuth ZachXBT was the primary to formally hyperlink Lazarus Group to the Bybit hack. Supply: Arkham

“For those who ask who probably the most influential particular person in crypto was in 2025, I might say Kim Jong Un. Regardless of the political consideration on crypto laws and requirements alignment, what dominated the FATF report was the Bybit hack.”

Across the similar time, Singapore tightened its licensing regime, ordering unlicensed crypto corporations to both obtain permits or leave the market. Whereas Singapore drew a lot of the headlines, regulators in nations reminiscent of Thailand and the Philippines had been pursuing similar enforcement campaigns.

Custody safety and laundering assumptions break down

The {industry}’s understanding of each custody security and illicit fund movement shifted following the Bybit hack.

Shoham mentioned the breach made clear that the first weaknesses had been now not cryptographic.

Associated: Are you a freelancer? North Korean spies may be using you

“As soon as funds go away a compromised pockets, attackers can atomize and recompose worth throughout chains sooner than human response cycles,” he mentioned.

This shift modified the {industry}’s perspective from treating mixers as the first menace to recognizing that decentralized routing infrastructure itself permits large-scale, automated theft.”

The Bybit hack additionally reignited a long-running debate over crosschain infrastructure and the duties of decentralized protocols. As stolen funds moved throughout chains, consideration as soon as once more turned to routing networks reminiscent of THORChain and eXch, which have been used by attackers to swap assets with out counting on centralized intermediaries.

THORChain quantity spiked as Bybit hackers moved funds. Supply: THORChain Explorer

Supporters of decentralized fashions argued that such protocols are impartial infrastructure, designed to function with out discretion or gatekeeping. Critics countered that their structure makes them uniquely engaging for laundering giant volumes of stolen property, notably when mixed with automation and fragmented liquidity throughout chains.

Some swappers like eXch ended up shutting down not lengthy after the hack.

Bybit units new requirements for disaster response

The Bybit hack crystallized a broader shift in how the {industry} approaches each custody and compliance. As crosschain motion accelerates and static controls fall brief, exchanges and infrastructure suppliers are more and more anticipated to use governance on the degree of transaction conduct quite than rely solely on address-based restrictions.

For Bybit, the $1.4 billion breach may have marked the start of a protracted collapse. Given the alternate’s dimension, early fears centered on the potential of an FTX-like contagion that might have triggered one other industry-wide downturn simply as markets had been recovering.

As a substitute, the alternate’s response set a unique precedent. CEO Ben Zhou appeared publicly all through the incident, internet hosting livestreams to replace customers on restoration efforts. Somewhat than halting withdrawals, a typical reflex throughout crises, Bybit kept them open and sourced Ether from companion exchanges to satisfy instant buyer demand.

That strategy has since influenced how different platforms put together for and reply to main breaches.

Withdrawal freezes are now not the default response, and real-time communication has turn out to be a baseline expectation. Regardless of the dimensions of the hack, Bybit stays one of many largest exchanges globally and ceaselessly ranks because the second-largest platform by every day buying and selling quantity.

Journal: Big questions: Would Bitcoin survive a 10-year power outage?