Bybit Lost $1.46B to an Attack Audits Never Covered

Bybit's Feb. 21 cold-to-warm wallet transfer looked routine on the screens of authorized signers: the destination address matched what they expected. Underneath, the transaction gave an attacker control of the wallet. The exchange later put the loss at $1.46 billion, the FBI attributed it to North Korea, and CryptoSlate reported roughly 401,347 ETH plus several staked Ethereum positions were drained. Safe said a compromised developer machine shaped the malicious proposal; its smart contracts and front end were never the vulnerability.

Why it matters

The incident is the clearest demonstration yet that an 'audited' badge has never covered the layer where the largest losses actually originate. An Oak Security preprint by Stefan Beyer compared 23,818 public audit findings from 22 firms against 218 incidents cataloged by rekt.news between January 2022 and March 2026, a dataset totalling an estimated $7.764 billion in losses. Logic and business-logic defects made up 14.6 percent of all audit findings, with code quality at 13 percent, input validation at 10 percent, and access control at 9.8 percent. The three leading categories together account for 37.6 percent of what auditors find. By contrast, private-key compromise and phishing, which sit largely outside standard contract review, accounted for 43.9 percent of stolen value. Adding dependency and governance attacks brings Beyer's 'human-vector' share to 49.6 percent of losses.

Market impact

Of the 218 incidents, 105 involved a protocol that had previously been audited; those events represented roughly $4.3 billion, or 55 percent of observed losses. The number does not establish that auditors missed exploitable code, since audits cover a specific commit hash and perimeter that frequently diverge from production deployment, configuration, and operational controls. Bybit alone contributed $1.43 billion of the $1.51 billion phishing total, around 18.4 percent of every dollar in the dataset. The paper's prescription, replacing the 'audited' badge with a standardized nutrition label naming the audited commit, deployed bytecode match, production configuration, key management, and front-end infrastructure, gives every layer of the stack its own review line. Bybit could absorb the lesson without losing users; most protocols cannot fund a $1.46 billion replenishment, and rebuilding reserves fixes the balance sheet but not the approval process that emptied it.