Bybit’s reserve check showed full coverage—and its limits

Bybit released its 29th proof-of-reserves disclosure on December 24, 2025, reporting that the assets examined by Hacken exceeded the corresponding customer liabilities at the report's December 17, 2025, 08:00 UTC snapshot. The document is meaningful evidence about a defined set of wallets, assets and customer balances. It is not a complete audit of the exchange or a guarantee that the same coverage existed seven days later.

What the snapshot showed

For four heavily used assets, Bybit's release gave both the claimed customer balance and wallet balance. It reported 59,711 BTC in user assets against 63,206 BTC in wallets, a 105% reserve ratio; 528,519 ETH against 536,845 ETH, or 101%; 5.9 billion USDT against 6.1 billion USDT, or 102%; and 583.5 million USDC against 658.4 million USDC, or 112%. The stablecoin figures were rounded in the release, so readers cannot independently reproduce the displayed percentages to full precision from those abbreviated numbers alone.

Hacken's 24-page report listed 40 in-scope assets and more than 65 million liability holders. Its collateral table marked every covered asset above 100%. The assessor said it reviewed the code used to generate Bybit's Merkle tree, compared the tree output with the liabilities report, recalculated root hashes and tested Merkle proofs. For reserves, Hacken obtained wallet addresses from Bybit management and observed small outgoing transactions from the supplied addresses to test control at the assessment time.

That combination addressed two different questions: whether the reported customer balances were consistently represented in the liability tree, and whether Bybit controlled the disclosed wallets holding the assets used for coverage. The published Merkle root and verification-code commit created a route for technically capable customers to check inclusion of their own balances.

Why this mattered

Centralized exchanges ask customers to transfer assets into infrastructure customers do not directly control. A recurring proof-of-reserves process can reduce one part of that information gap by making selected liabilities and on-chain holdings testable instead of leaving both as unsupported management assertions.

The December disclosure also showed where the cushion was narrowest among the four headline assets. ETH coverage was reported at 101%, compared with 112% for USDC. That comparison is descriptive, not a risk forecast: the ratios are asset-specific snapshots, and a larger percentage does not by itself establish better liquidity, safer custody or stronger corporate finances.

What proof of reserves did not prove

The strongest caution came from Hacken's own disclaimer. It described the work as a point-in-time attestation of on-chain assets based on provided and verified addresses and data, not a comprehensive financial audit of all assets, liabilities or Bybit's overall financial position. The report made no warranty about technical-security findings and warned that the assessment might cease to be relevant after changes.

Those limits are material. The procedure cannot establish from this public report alone whether every corporate liability was captured, whether assets were pledged elsewhere, how readily every reserve could be liquidated under stress, or what happened after December 17. Even the finding on wallet control was bounded to the addresses supplied by management and the audit moment.

The verified conclusion for December 24, 2025 is therefore narrower than the promotional shorthand “fully solvent.” Bybit published a third-party-assessed reserve snapshot in which all 40 covered assets were reported above 100% against the in-scope customer liabilities. It added useful transparency, while leaving the exchange's complete balance sheet, security posture and continuously changing liquidity outside the proof.