Glassnode Report Highlights Bybit’s Historic Recovery After $1.4B Lazarus Hack

• The results emphasize Bybit’s extraordinary recovery rate and how the exchange’s zero-time reaction helped limit a possible catastrophe.
• The reaction of the industry to the attack of Bybit-Lazarus marks the beginning of a new era of resilience in the digital asset market.
• Bybit’s deep liquidity, which had been regarded for a long time to be one of its primary competitive advantages, was called into question after the attack.

Glassnode, the leading onchain market intelligence provider recognized by top-tier financial institutions all over the globe, has recently released a a new research report that highlights Bybit, which is the second-largest cryptocurrency exchange in the world based on trading volume. The results emphasize Bybit’s extraordinary recovery rate and how the exchange’s zero-time reaction helped limit a possible catastrophe by absorbing market shock that might have thrown the cryptocurrency sector into a downward spiral. Bybit’s recovery rate was unparalleled.

The comprehensive report, which is titled Digital Asset Market Resilience: A Deep Dive into the Bybit-Lazarus Hack, examines the timeline, trading activity, and critical market data from the unprecedented cyber attack that occurred in February 2025. This attack was the largest crypto hack in history, with a total value of $1.4 billion. Additionally, the report benchmarks the attack against major disruption events that occurred in both the traditional financial markets and the digital asset and cryptocurrency markets. The reaction of the industry to the attack of Bybit-Lazarus marks the beginning of a new era of resilience in the digital asset market, which is in contrast to the past patterns of financial crises and crypto crashes.

Perpetual Open Interest and Volumes Recovery

The performance of three important assets that are traded on Bybit — Bitcoin, Ethereum, and Sol — was analyzed in this research. As a result of extensive position unwinding and forced deleveraging, the open interest in Ethereum on Bybit underwent one of the most severe contractions ever recorded on February 22, the day following the hack that occurred. Nevertheless, throughout the course of the subsequent two months, open interest fluctuations shifted in a largely positive direction, with the majority of values recovering to their long-term averages and sometimes surpassing the regular volatility thresholds seen.

Following the hack, Bitcoin and SOL followed a path that was comparable to that of Ethereum. During the month of May, Bitcoin and SOL both accomplished important milestones, with Bitcoin reaching a record peak in futures perpetual open interest at $8.5 billion and SOL reaching $1.2 billion. The report states that all three have been restored to their pre-hack levels at the time of publication.

The analysts in the report wrote:

“When examining perpetual trade volumes for the Ethereum asset, we observe stability in trading activity before and after the hack event, with volumes remaining largely unchanged. Additionally, following Ethereum’s outperformance in recent weeks, trade volume on Bybit has surged, reaching a new all-time high of $8.5B/day, a remarkable milestone given that Ethereum was the primary asset targeted in the hack.”

Narrowing Spreads: Liquidity Conditions Stabilized

Bybit’s deep liquidity, which had been regarded for a long time to be one of its primary competitive advantages, was called into question after the attack. The market liquidity was facing acute stress as a result of the bid-ask spreads being much wider and the market depth becoming significantly less. During the moment of uncertainty, the phenomena suggested that a significant number of participants withdrawal. Within the first twelve hours following the security compromise, the exchange processed a record-breaking 350,000 withdrawals.

However, from the middle of April, both indicators have seen a consistent recovery. The bid-ask spreads have returned to pre-incident levels, and market depth has actually surpassed pre-hack values by the month of May. This indicates that market maker trust has been restored and that trading conditions have returned to normal.

Breaking the Crisis Pattern: Why the Bybit Hack Didn’t Trigger Industry Collapse

A small dent was left in Bybit’s liquidity as a result of the hacking incident, but the exchange quickly recovered to its pre-hack levels. This prevented the hacking issue from escalating into widespread panic with widespread systemic pressure.

Glassnode established a unique model that was based on two critical indications in order to evaluate the operational stability of Bybit. These indicators are the Internal Reshuffling Ratio and the Whale Withdrawal Ratio. As a result of the hack, both metrics saw a period of spikes before reverting to their regular levels.

As a result of Bybit’s “swift operational response, transparent communication, and strong internal controls,” the report said that the exchange was able to preserve client assets, maintain platform integrity, and manage contagion risk. This was the reason why market spillover was prevented.

The report contributes to the expanding body of analytical literature on the historic hacking event, the aftermath of which highlighted the industry’s rising resilience by avoiding the systemic collapse that was observed in prior crises like as FTX and Terra. Not only did Bybit prevent harm that might have affected the whole market, but it also caused important assets to achieve new trading records, demonstrating that institutional-grade processes are now ingrained in the markets for digital assets. The occurrence of this event signifies a significant change in the ability of cryptocurrency to absorb large disturbances, which has the potential to alter investor confidence and accelerate the maturing of the market. Those who are interested in learning more about the report may go to the Glassnode Insights.