- On 21 February the Bybit platform suffered a theft of around 1.5 billion dollars in crypto-assets, the largest on record.
- It was attributed to a North Korean hacking group; the attack targeted a platform that holds client funds.
- Before dealing in a digital asset, it is worth knowing where the funds are and who controls the keys.
On 21 February 2025, the crypto-asset platform Bybit suffered a theft of around 1.5 billion dollars. It was the largest theft of its kind recorded until then and was attributed to a North Korean hacking group. Beyond the figure, which is impressive on its own, the episode put back on the table a basic question for anyone who holds digital assets: who keeps them, how they are protected and what happens if something goes wrong.
Crypto-assets are a relatively young market, in which serious projects coexist with highly risky ones, and in which the protection the law gives the user is not always equivalent to that of traditional financial products. An incident of this size does not invalidate a whole class of assets, but it is a reminder that technology, however sophisticated, does not remove operational risk or custody risk.
An unwelcome record
The attack was aimed at an exchange platform, that is, a company that holds its clients’ funds and therefore concentrates an enormous amount of assets in one place. That concentration makes it an attractive target for those looking for a large haul, and obliges the platform to maintain security commensurate with what it holds.
The size and the attribution to an organised group serve as a warning to any company that holds assets for third parties. When an attack is backed by organisations with extensive technical resources, a company’s defences must be up to the task, and it is wise to assume that the risk of cyberattack is not hypothetical but constant for anyone who holds digital value.
Who holds the assets
The security of custody is the first question for any digital asset. Leaving assets on a platform is not the same as holding them under your own control with the right protections: in the first case you depend on the security and solvency of a third party; in the second, on your own discipline with keys and backups.
Neither option is perfect. Trusting a third party spares you the technical work but moves the risk to its organisation; keeping the keys yourself removes that dependence but requires not losing or exposing them, because in this field a mistake is usually irreversible. The choice depends on the amount, on each person’s experience and on what they are prepared to take on.
What to ask yourself
Before dealing in a digital asset, it is worth knowing where the funds really are, who has access to the keys, what protections exist and what would happen in the event of an incident. These are questions any serious platform should be able to answer clearly, and the absence of answers is itself information worth taking into account.
The more wealth at stake, the more it matters that those answers are clear, and it is sensible to rely on specialist advice. It is also wise to limit the part of one’s wealth exposed to this kind of risk and to document how the assets are accessed and who would be informed if needed, for example in the event of death or incapacity, so that access does not depend on a single person.
In digital assets, security is not a technical detail: it is part of the investment.
This article is general information. It is not legal, tax or investment advice, and it does not take anyone’s particular circumstances into account.
