Bybit Rebounds to Second-Largest Exchange Despite $1.5B Cold‑wallet Breach

A major February 2025 compromise of Bybit’s cold custody led to the theft of roughly $1.5 billion in Ether and triggered immediate operational and reputational stress across the exchange. The firm’s decisions to keep withdrawals active, meet user claims, and seek external liquidity support appear to have blunted a deeper exodus, while visible leadership engagement helped stabilize client confidence. By year‑end CoinGecko data place Bybit second in global spot trading activity with annual volumes of about $1.5 trillion and an 8.1% share of market turnover, evidence that business volumes can rebound quickly after a severe security incident under certain conditions. The broader exchange landscape also expanded in 2025: aggregate trading increased and several top platforms posted volume gains, with some venues benefitting from fee policies and aggressive user acquisition tactics. Binance retained the largest volume footprint, near $7.3 trillion for the year, although its annual turnover edged down slightly versus the prior year. MEXC emerged as a standout gainer, nearly doubling activity as zero‑fee strategies pulled high‑frequency and retail flows into its order books. The contrast between exchanges that surged and those that stagnated illustrates how fee structures, product mix and market sentiment interact with single‑firm crises to redistribute trading flow. From a security engineering perspective the attack underscores persistent vulnerabilities in cold‑wallet architectures and the leverage such weaknesses give sophisticated state‑linked actors. From a market‑design vantage point, Bybit’s case shows that quick liquidity provisioning and honor‑of‑claims policies reduce immediate systemic contagion but do not eliminate long‑term trust erosion risks for counterparties and regulators. The near‑term recovery benefited from a bullish crypto cycle in 2025 that amplified trading demand and masked some confidence deficits that would have been more damaging in a stagnant market. Policymakers and institutional participants will likely scrutinize custody and insurance arrangements more closely, increasing pressure on exchanges to adopt multi‑party control, diversified cold storage, and clearer recovery playbooks. Ultimately, the episode functions as a stress test for centralized venues: it confirms that operational resolve and market tailwinds can restore volume, while also proving that single‑point custody failures remain one of the clearest existential threats to exchange credibility and market stability.