Bybit refuses to halt withdrawals
On February 21, 2025, North Korean hackers compromised the Safe environment used during a transfer from one of Bybit’s Ethereum cold wallets. Around $1.5 billion in crypto disappeared. The FBI would officially attribute the operation several days later to North Korean actors tracked under the name TraderTraitor.
The attack remains a reference point in discussions about Lazarus operations and the laundering of stolen crypto.
Watching the situation from the outside, CZ publicly urged Bybit to suspend all withdrawals until it could verify that no other vulnerabilities remained.
Ben Zhou refused.
His team had determined that the incident involved the external multisignature tool, not the exchange’s general withdrawal system. Keeping withdrawals open also offered a way to show that Bybit remained solvent despite the enormous shortfall.
The decision triggered a rush. Bybit said it processed more than 350,000 withdrawal requests, with 99.994% completed within the ten hours following the attack.
Nineteen months later, Kevin Follonier asked CZ directly whether he believed Ben Zhou had been right and he had been wrong.
His answer was far less definitive: in this kind of situation, he explained, “there is no right or wrong choice.” Zhou simply had more information available.
CZ would still have pressed the red button
That does not change CZ’s personal approach.
During the latest episode of When Shift Happens, he described a “big virtual red button”: when a major security incident occurs, he prefers to shut down the systems, determine precisely what was compromised, and then bring them back online gradually.
CZ applied that doctrine at Binance in May 2019, when 7,000 BTC, then worth around $40 million, were stolen. Binance suspended withdrawals for roughly a week.
The reasoning favors the worst-case scenario. If an initial vulnerability exists and its scope remains unknown, keeping outflows open could enable a second attack.
Recent experience shows why that caution remains relevant. BrefCrypto had already recorded 70 crypto hacks in the second quarter of 2026. Incidents now affect wallets, bridges, interfaces, third-party providers and signing systems. Identifying the entire compromised attack surface immediately is difficult.
CZ even believes that any person sufficiently close to an exchange’s operations should be able to trigger this emergency shutdown mechanism.
Only then should the analysis begin.
Bybit prioritized user confidence
Bybit’s decision addressed another risk, however: a crisis of confidence.
Suspending withdrawals minutes after $1.5 billion disappeared would immediately have fueled questions about the exchange’s solvency. In the aftermath of FTX, the words “withdrawals suspended” carry particular weight in the crypto market.
Ben Zhou knew precisely where the attack had occurred. Bybit said its internal infrastructure had not been compromised and that its other cold wallets were operating normally. Two days after the incident, the exchange announced that it had secured enough liquidity through bridge loans, deposits and OTC purchases to cover its ETH shortfall.
The gamble therefore paid off. No second theft followed.
CZ acknowledges this himself: suspending withdrawals probably would not have changed the outcome of the incident very much, unless a second attack had been possible.
That is where the real debate lies. The Liquid Network case, which recently chose to suspend its network after an abnormal movement of nearly 4,000 BTC, shows that an emergency shutdown remains a response used when the scope of the risk is still unknown.
Bybit had more information and chose continuity. CZ, with less visibility, would have chosen to shut down.
No formula works in every situation. After a crypto hack, only a few minutes may separate an unnecessary precaution from a second massive theft. The real advantage may not be always pressing the red button, but having enough information to know when it needs to be pressed.
