How Did the Largest Hacking Attack Impact the Crypto Market?

Less than two months ago, the crypto exchange Bybit became a victim of one of the largest hacking attacks in the history of the crypto sector, losing approximately $1.5 billion in Ethereum to the North Korean cyber criminal group Lazarus. While the leading trading platform has significantly recovered from the effects of the attack, market experts analyzed data that showed how it managed the incident.

A postmortem report obtained by the crypto institutional research firm BlockScholes reveals how deeply the hacking affected the broader crypto market, the range of supply and demand, and the role of Bybit’s new Retail Price Improvement (RPI) orders in the platform’s recovery.

How Did Bybit’s Hack Affect the Market?

Let us recall that the target of the attack was one of Bybit’s cold Ethereum wallets. BlockScholes revealed that the sell-off that followed the incident was not unique to crypto, as the market had already witnessed a significant reduction in risk due to several macro events, including tensions over tariffs and the launch of DeepSeek’s artificial intelligence model.

Analyzing the impact of the hacking on spot trading volume, analysts noted a temporary spike in hourly volume for all USDT pairs far from the average. After the spike, there was a significant decline in trading volume for Bitcoin and altcoins in the following days.

Bybit’s market share in spot trading fell from 11% to 4%, and the share of Bitcoin traded dropped from 50% to below 20%, while Ethereum volumes remained relatively stable. Although volumes have yet to return to the high levels seen at the beginning of the year, there has been a significant recovery. The total share in spot trading increased to 6% to 7%.

Despite the decline in trading volume, the spread of supply and demand remained small. This metric measures the difference between the lowest asking price and the highest bid price. A lower spread indicates greater liquidity and lower execution risk.

Rapid Recovery

After the hacking on February 21, only Pepe and Trump witnessed a significant change in order book depth. Bitcoin, and even Ethereum, the assets stolen during the attack, had the lowest spreads, recording negligible changes after the incident. However, the order book depth for Bitcoin and Ethereum quickly recovered within a week, attributed to Bybit’s RPI orders.

RPI orders aim to increase liquidity exclusively for retail traders. This feature is a unique subset of orders placed by market makers or institutional participants that is open only to retail traders who manually interact with Bybit’s user interface.

Bybit introduced RPI orders on February 17, a few days before the hacking. Thus, while the market was trying to recover from the incident, there was good order book depth, large liquidity pools, and lower supply and demand spreads for traders on Bybit.