Bybit’s $1.46 billion breach set the reference point for centralized exchange risk, but the firm is now framing AI as the tool that kept a bad year from becoming much worse. The exchange says those systems saved $700 million, a figure that puts a hard number on a security argument bitcoin developers have been circulating for weeks.
That claim, detailed in the original CoinDesk report, matters less for the dollar amount than for who is making it. Bybit is the first large centralized venue to move beyond vague statements about AI monitoring and publish a specific savings figure after suffering one of the largest thefts in crypto history.
The timing is not accidental. North Korean hacking groups remain the most persistent operational threat to exchanges, and the industry has struggled to show that post-breach spending on detection and transaction screening produces measurable protection. A $700 million figure, even if unaudited, changes the conversation from theoretical capability to claimed outcome.
The math behind the claim
Bybit has not released a detailed breakdown of how the $700 million was calculated. That alone should keep analysts cautious. Savings estimates in security are often derived from losses that might have occurred, not from hard ledger entries. Still, the scale is plausible when measured against the cost of multi-hour withdrawal freezes, asset recovery efforts, and the subset of transactions that AI models may have flagged before funds moved.
The exchange has been rebuilding its infrastructure since the hack. AI-based monitoring for suspicious withdrawal patterns, address blacklisting, and real-time anomaly detection have become standard talking points across centralized venues. The difference is that Bybit is now willing to attach a dollar figure, which sets expectations for future disclosures from other operators.
That shift has implications for how exchanges market their compliance programs. Risk officers have long wanted security investment framed in terms of expected loss reduction; traders rarely see those numbers. Bybit’s disclosure invites a more standardized approach, even if that standard does not exist yet.
This also feeds a wider AI push across crypto. Projects are pairing decentralized compute with AI workloads, from scalable AI-driven Web3 applications to storage networks where AI storage demand is becoming a price narrative. Security budgets are part of that capital flow, even if they receive less attention than consumer-facing AI products.
What remains unresolved
No external auditor has verified the $700 million figure, and Bybit’s statement does not define the period or methodology clearly enough for traders to compare it against industry benchmarks. That gap is significant. Without a consistent baseline, AI savings claims can become a marketing metric rather than a risk metric.
There is also tension between the exchange’s security narrative and the unresolved threat from North Korean groups. The original theft showed that state-backed actors could move assets through core exchange infrastructure, not just target individual user accounts. If the control failure was in the internal transfer process, AI transaction monitoring is only a partial fix. It does not eliminate the need for stronger key management and human authorization controls.
Regulators are watching the same issue. As Washington continues to debate the country’s largest crypto market-structure package, the legislative fight over exchange oversight shows how security failures at centralized venues feed into broader policy arguments. A public AI savings number could be used either to argue that exchanges can self-regulate effectively or to demand stricter custody standards.
The harder question for exchanges
Bybit is not claiming AI would have prevented the original attack. The $700 million figure is about operational defense after the fact. That distinction matters. The industry needs to know whether these tools stop sophisticated state-backed actors or primarily reduce the smaller-scale fraud that often follows a major breach.
For users, the more important test is whether onboarding and withdrawal controls became stricter without slowing normal trading. Exchanges that overcorrect can push volume to venues with fewer checks, which creates a different kind of risk.
The next few months will show whether other exchanges try to match Bybit’s disclosure with their own numbers. If they do, the market will finally have a comparison set for AI security spending. If they do not, Bybit’s figure will remain a lonely data point, useful for headlines but not yet strong enough to settle the debate over whether AI meaningfully improves exchange security.
