The platform has assured users of its liquidity—despite a significant increase in the volume of withdrawals in the wake of the breach—promising refunds to all affected users even if the stolen money is not recovered.
According to Osama Bari, Chief Technology Officer at D24 Fintech Group, exchanges that comply with a core set of rules will drastically reduce their chances of suffering a similar breach.
1. Multi-party approval systems
The Bybit security breach was primarily caused by vulnerabilities in multi-signature authorization and UI spoofing tactics, where attackers manipulated the interface to display different addresses. Bari said: “Even experienced professionals might overlook such discrepancies without a thorough investigation. Typically, such issues often go unnoticed during routine exchange operations.
“To mitigate such risks, exchanges should implement a threshold-based, multi-party approval system for all transactions.
“Additionally, secure platforms require real-time monitoring systems to analyze deposits and withdrawals, with automated cross-checks for unusual spikes. If required, large transactions must be manually verified with a comprehensive report. Each withdrawal should undergo a transaction audit score assessment before being processed.”
2. Ensure two-factor authentication is in place
Two-factor authentication (2FA) is a security method that requires a second form of identification to access any account information or funds.
Bari: “2FA is no new phenomenon, but its importance as a tool for verifying users and ensuring only the right personnel can manage and withdraw balances or view confidential information cannot be understated.
“This is a basic form of protection that exchanges should absolutely be offering to their customers and can be a vital deterrent for hackers as it increases the difficulty of breaching gated accounts. All financial providers have a duty to protect their users and 2FA is a guaranteed way of raising the level of in-built security they provide.”
3. Custodians are valuable third parties
Custodians safeguard assets for fellow financial institutions to reduce the risk of loss, theft, or damage.
Bari continued: “Exchanges should not underestimate the level of responsibility that comes with holding considerable volumes of assets on behalf of customers. Failure to put the appropriate measures in place to protect these funds, as we’ve just seen with the Bybit hack, could result in disastrous consequences for both the company attacked and the users impacted.
“Turning to external organizations to bolster security is a viable option for exchanges that lack the infrastructure and liquidity to manage millions, or even billions, worth of currency. Partnering with a trusted custodian will ensure that customer investments stay safe, allowing exchanges to focus on other important activities such as enhancing user experience and increasing the financial literacy of their customers.”
4. Perform a liveness check
A liveness check verifies a user’s identity through a biometric measure, for example, their face or fingerprint. 40% of banks have implemented this precaution to tackle fraud, up from 26% five years ago.
Bari: “For crypto exchanges, and financial institutions more generally, a liveness check adds that final layer of protection to dissuade hackers from attempting an attack. Having access to passwords, secure keys, or even primary devices is no longer enough to successfully bypass security measures—customers are protected as their face, fingerprints, and even voices are all unique.”
5. Make security CEXy
Centralized cryptocurrency exchanges (CEXs) are regulated intermediaries that facilitate the trading of fiat and digital currencies.
Bari concluded: “A pivotal element of cryptocurrency’s appeal throughout its history has been its decentralized nature, with many early adopters drawn to this form of tender by its anonymity. However, as crypto has become increasingly mainstream and a viable investment for individuals globally, it’s important to reshape our thinking and start putting security at the top of the list of priorities.
“Due to Bybit’s centralized approach, the exchange was able to freeze $42.85 million in stolen assets within 48 hours through collaborations with other platforms. This highlights the increased resilience of CEXs and how trusted partnerships with other organizations in the crypto field can limit the damage inflicted in a hack.”