Bybit incident postmortem: How Bybit rose from the hack and protects its RPI retail users

Key Highlights:

• Security breach: On Feb 21, 2025, Bybit suffered a major security incident, losing $1.5 billion and triggering a widespread sell-off in the crypto market.

• Market impact: Bitcoin’s price dropped over 20%, and Bybit's market share plummeted from 11% to 4% immediately after the hack.

• Introduction of RPI Orders: Retail Price Improvement (RPI) orders, launched just before the hack, helped enhance liquidity for retail traders and stabilize trading conditions.

• Recovery in trading volumes: Bybit’s market share rebounded to approximately 6–7% as trading volumes recovered, driven by improved liquidity and trader confidence.

• Shift in trading behavior: Bitcoin’s trading volume share fell below 20%, while altcoins and meme tokens gained traction, reflecting changing market dynamics.

• Positive outlook: Bybit’s proactive measures and its successful implementation of RPI orders position the exchange favorably for future growth in the competitive DeFi landscape.

Incident overview and immediate impact

On Feb 21, 2025, Bybit, the world's second-largest cryptocurrency exchange, faced a major security breach when an exploit of its Ethereum cold wallet resulted in a loss of $1.5 billion. This incident triggered a broad sell-off in the cryptocurrency market, with Bitcoin’s price dropping over 20%. The market reaction indicated that the hack was part of a larger trend of de-risking across crypto assets, exacerbated by macroeconomic factors such as rising tariffs and changing global risk appetite. Although there was a temporary spike in trading volumes for USDT pairs immediately after the hack, this increase was short-lived, and did not lead to sustained trading activity.

Recovery of trading volumes and bid-ask spread

In the days following the hack, Bybit's market share in spot trading plummeted from approximately 11% to around 4%. However, the exchange demonstrated resilience as it began to recover, with market share rebounding to about 6–7%. This recovery was facilitated by the introduction of Retail Price Improvement (RPI) orders on Feb 20, 2025, which enhanced liquidity specifically for retail traders. 

Figure 1. Bid-ask spreads for selected USDT spot pairs from Feb 20–Apr 1, 2025, with the security incident marked by a dotted line on Feb 21, 2025. Source: Bybit data analytics

Figure 2. BTCUSDT spot order book depth within 5 and 10 basis points of the mid-price, measured daily from Feb 20–Apr 1, 2025. Source: Bybit data analytics

Despite the initial drop in order book depth, particularly for Bitcoin and Ethereum, liquidity conditions improved significantly due to RPI orders, which deepened the order books and maintained tight bid-ask spreads. This stability in spreads indicated sustained liquidity, allowing traders to execute orders with minimal price slippage.

Shift in trading behavior, and future outlook

Figure 3. Bybit’s spot volume market share as a proportion of market share of the top 20 CEXs. Sources: CoinGecko, Block Scholes

The aftermath of the hack also brought a notable shift in trading behavior. Bitcoin’s proportion of trading volume fell below 20%, contrasting sharply with its usual dominance of 40–50%. In response, altcoins and meme tokens gained popularity, with their trading volume peaking at nearly 60% during this period. Bybit's proactive measures, including the successful rollout of RPI orders, have not only stabilized liquidity, but have also enhanced the overall trading experience for retail investors. As Bybit continues to rebuild market confidence and improve liquidity conditions, it’s well-positioned for future growth in the competitive cryptocurrency exchange landscape. The metrics reflect a consistent recovery in trading activity, indicating a strong outlook for the platform moving forward.

#BybitLearn #BybitResearch