Post-hack reserve check put Bybit above 100% on covered assets

Hacken issued an ad hoc proof-of-reserves report dated February 23, 2025, finding that Bybit’s disclosed holdings exceeded corresponding customer liabilities for each of 40 covered digital assets. The snapshot arrived two days after Bybit disclosed that attackers had drained roughly $1.5 billion in cryptocurrency from an Ethereum cold wallet.

The finding mattered because Bybit was facing the central test for a custodial exchange after a major loss: whether customers could withdraw assets while the platform still controlled enough reserves to meet the liabilities represented in its records. The report supplied direct evidence about selected on-chain holdings and customer balances. It did not prove Bybit’s complete solvency or establish that its security failures had been corrected.

What the report tested

The February 23 assessment covered assets including BTC, ETH, SOL, USDT and USDC across 30 listed networks. Hacken said the liability dataset contained more than 65 million holders and included positive customer balances for the in-scope assets. Every asset in the report’s collateral table was marked above 100%; the document did not publish more precise asset-by-asset percentages or the underlying quantities.

For liabilities, Hacken reviewed the code used to generate Bybit’s Merkle tree, compared its output with the liabilities report, recalculated root hashes and examined proofs through Bybit’s published validation tool. A Merkle tree lets individual customers test whether their balance was represented without publishing every account balance openly.

For reserves, Hacken said Bybit management supplied the complete list of addresses holding covered assets. Bybit then initiated small outgoing transactions from those addresses using amounts defined by Hacken. Observing those transactions demonstrated control of the supplied addresses at the assessment time.

Why the timing mattered

Bybit had disclosed the wallet compromise on February 21, 2025. The Associated Press reported that withdrawal requests surged after the announcement and that the exchange warned processing could be delayed. Bybit’s chief executive, Ben Zhou, publicly maintained that the platform could absorb the loss even if none of the stolen assets were recovered.

Against that background, the February 23 reserve check was more informative than another unsupported assurance. It tested whether the exchange controlled identifiable blockchain assets and whether the reported customer liabilities were consistently represented in the reviewed dataset. The result supported the narrower conclusion that covered reserves exceeded covered liabilities at the snapshot.

The report did not establish where replacement liquidity originated, whether any assets had been borrowed or pledged, or whether every corporate obligation was included. It also did not measure the exchange’s ability to liquidate reserves during continued withdrawals. A token-by-token ratio above 100% is not equivalent to an audited balance sheet, a cash-flow analysis or a regulatory capital calculation.

Proof of reserves was not a security audit

Hacken explicitly said its work contained no finding or warranty about technical security. That distinction was material: the February 21 loss resulted from a compromised transaction-signing process, while the February 23 assessment examined reserves and liabilities. Passing the latter did not explain the intrusion or certify that another compromise could not occur.

The report’s disclaimer also described the work as a point-in-time attestation based on provided and verified blockchain addresses and data—not a comprehensive financial audit of all assets, liabilities or Bybit’s overall financial position. Because cryptocurrency balances and customer withdrawals change continuously, the result could become stale immediately after the snapshot.

The defensible February 23 conclusion was therefore limited but important. Following an exceptional custodial loss, Bybit produced a third-party assessment showing more than 100% coverage for every in-scope asset. That reduced uncertainty about the disclosed reserve position while leaving asset encumbrance, off-chain obligations, liquidity durability and security remediation unresolved.