Bybit Pushes Institutional Trust as Its $1.5 Billion Hack Still Looms

Bybit’s global head of TradFi and real-world assets told a Dubai conference on July 13 that trust, not blockchain technology, will decide who wins the next wave of institutional crypto adoption. Yoyee Wang made the case at LEAP East 2026, the same stretch of summer in which Washington’s own crypto rulebook sat stalled past the White House’s target date.

The pitch carries a complication. Bybit is also the exchange that survived crypto’s largest hack, a breach of roughly $1.5 billion in February 2025, and it is now asking funds, banks and compliance officers to weigh a recovery story as part of the trust calculus.

Bybit’s Trust Pitch Lands in Dubai

Wang spoke on a panel called her panel on trust as new infrastructure, alongside policymakers and financial executives at LEAP East 2026 in Dubai. Bybit is the world’s second-largest cryptocurrency exchange by trading volume, serving more than 80 million users globally, and Wang’s title on this appearance marks a step up from the business-development role she held as recently as December.

Institutional adoption has never been about chasing the highest returns. For professional investors, trust begins with capital preservation, regulatory certainty and infrastructure they can rely on.

Wang said that at the Dubai panel. She added that once those foundations are in place, innovation becomes easier for institutions to embrace, and that regulation has shifted for Bybit’s clients from a compliance obligation into what she called a strategic differentiator.

What Do Institutions Actually Want From a Custodian?

Bybit executives describe institutional demand in specific terms: security and control over assets, capital-efficient custody structures, regulatory clarity across jurisdictions, and tokenized products built with recognized banks rather than experimental protocols. Those four requirements, repeated across Wang’s public remarks in Abu Dhabi and Dubai, now double as the industry’s checklist for winning institutional flow.

Speaking in December at an HSC Asset Management conference in Abu Dhabi, Wang said discussions with institutional clients about custody usually start with security. She said the underlying question for most funds is how clients can trade more efficiently while managing risk, not just where assets sit. She pointed to tokenized products built with Qatar National Bank and UBS as proof Bybit favors established partners over untested structures.

• Security and control – institutions want visibility into who holds keys and how assets move, not just a login and a balance.
• Capital efficiency – as multi-party and off-exchange custody spreads, funds don’t want capital locked up unnecessarily to support trading activity.
• Jurisdictional clarity – Wang pointed to the UAE’s evolving rulebook as the kind of regulatory certainty that lets institutions commit.
• Bank-grade partners – products tied to known institutions, rather than untested protocols, are what get through a fund’s investment committee.

That last item is why the custody race extends beyond exchanges. Standard Chartered recently backed Hong Kong’s first bank-backed crypto custody venture, a reminder that global systemically important banks are building the same trust infrastructure Bybit is pitching, just from the other side of the ledger.

The $1.5 Billion Hack Still in the Room

On February 21, 2025, North Korean hackers linked to the Lazarus Group’s TraderTraitor unit stole between $1.4 billion and $1.5 billion in Ethereum from Bybit’s cold wallet. It remains the largest cryptocurrency theft on record.

The mechanics were not a smart contract exploit. Attackers compromised a Safe{Wallet} developer, hijacked AWS session tokens and altered what Bybit’s signers saw on screen, tricking them into approving a transaction that handed over control of the wallet. Analysts at NCC Group later described it as a blend of supply chain compromise and interface manipulation rather than a straightforward server breach.

Bybit’s reserve ratio, comfortably above 100% before the attack, fell to 92% of liabilities in the immediate aftermath, according to one policy review of the largest cryptocurrency heist in history. Co-founder and CEO Ben Zhou secured bridge loans from industry partners covering roughly 80% of the stolen ETH, about $1.12 billion, avoiding a fire sale of remaining reserves. Hacken, the firm that audits Bybit’s reserves, posted publicly within hours that user funds remained fully backed even as the breach unfolded.

Reserves Audited Monthly, Not Always Climbing

Since June 2024, Bybit has published a Proof-of-Reserves snapshot roughly every month, independently checked by Hacken. The reports show reserve ratios by asset, not a single number, and the trend line is not a straight climb.

Between the April and May snapshots, mainstream asset value actually slipped, from $17.0 billion to topped $16.5 billion in mainstream assets, a reminder that reserve size tracks market conditions as much as user growth. What has stayed constant is the audit cadence itself, monthly reserve audits dating to June 2024, which Bybit now treats as a baseline rather than a crisis response.

Tokenized Assets Cross $33 Billion, Most of It Idle

Wang’s pitch leans on a broader shift: real money moving into tokenized versions of traditional assets. On-chain value tracked by rwa.xyz hit roughly $33.5 billion as of July 8, 2026, nearly tripling in a year.

• $33.5 billion in on-chain real-world asset value tracked by rwa.xyz as of July 8, 2026, up from about $11.8 billion a year earlier.
• $12.9 billion to $16.2 billion in tokenized US Treasuries, still the category’s clear heavyweight.
• $2.5 billion in BlackRock’s BUIDL fund as of May 25, 2026, now tradable on Uniswap through UniswapX.
• $32.9 billion sitting in tokenized products with zero weekly transfer activity, per a BeInCrypto Research review cited by Forbes.

That last figure is the catch. A Forbes review of the tokenization market found $32.9 billion in dormant tokenized value sitting across 910 assets with no weekly transfers, out of a market the underlying report tracked at $60 billion across 7,000 products. Michael Terpin, CEO of Transform Ventures, framed the mature use case narrowly. “The main use cases for RWA right now are for 24/7 global access to t-bills and public stocks, since traditional markets don’t allow this,” he said. Ripple has been assembling a similar institutional crypto stack through 2026, another sign that the infrastructure race Wang describes is not Bybit’s alone.

Is Washington Close to a Crypto Rulebook?

Not yet. The Senate Banking Committee advanced the Digital Asset Market Clarity Act on a 15 to 9 vote in May, but the bill still needs 60 votes on the floor, a stripped ethics provision is expected to resurface, and the White House’s own July 4 target has already passed without a final vote.

Only two Democrats, Ruben Gallego of Arizona and Angela Alsobrooks of Maryland, joined Republicans on the committee vote. The bill would make the Commodity Futures Trading Commission (CFTC) the primary regulator for large parts of the crypto industry while the Securities and Exchange Commission (SEC) keeps authority over digital securities, according to reporting on the bill’s committee vote win. Ethics language limiting officials from profiting off crypto was removed to secure that vote and is expected to return for a floor fight.

Public urgency does not match industry urgency. A CoinDesk-commissioned survey of 1,000 registered voters found just 1% named crypto a top priority heading into the 2026 midterms, a data point Senator Elizabeth Warren cited in opposing the bill. White House crypto adviser Patrick Witt had aimed for a July 4 finish; Senator Kirsten Gillibrand predicted the first week of August instead. Neither date has arrived.

The Last Signature Belongs to Compliance

Wang’s argument is that regulatory clarity, audited reserves and bank-grade partnerships are what convert institutional interest into wired money. Nothing in Bybit’s public record contradicts that framing. The Hacken audits are real and monthly. The UAE licensing is real. The tokenized products with Qatar National Bank and UBS are real.

None of that erases what happened in February 2025, and none of it finishes a bill still stuck in the Senate. Financial institutions built compliance operating models built before adding AI tools precisely because the sign-off always runs through a legal or compliance desk before capital moves, and that desk reads hack post-mortems as closely as reserve reports.

Bybit’s proof-of-reserves reports update on a fixed monthly schedule. The Senate’s crypto market structure bill does not.

Frequently Asked Questions

What is Bybit’s proof-of-reserves report?

It is a recurring disclosure, verified independently by the blockchain security firm Hacken, showing whether Bybit’s on-chain holdings meet or exceed what users are owed for each major asset. Bybit has published these snapshots roughly monthly since June 2024, well before its February 2025 hack forced the practice into the spotlight.

How much was stolen in the 2025 Bybit hack?

Hackers took between $1.4 billion and $1.5 billion in Ethereum from Bybit’s cold wallet on February 21, 2025, the largest crypto theft on record. At least $160 million of the stolen funds was laundered within the first 48 hours, according to a policy analysis of the breach.

What does the Clarity Act actually do?

The Digital Asset Market Clarity Act would split crypto oversight between two federal regulators, giving the CFTC primary jurisdiction over most digital assets while leaving the SEC in charge of digital securities. For comparison, last year’s stablecoin-focused GENIUS Act passed the full Senate 68 to 30; the Clarity Act’s path to 60 votes is far less certain.

How big is the tokenized real-world asset market?

Estimates vary by methodology. Rwa.xyz put on-chain distributed value at about $33.5 billion in early July 2026, while a separate industry report tracked $60 billion across 7,000 products once illiquid, permissioned tokens are included. BlackRock’s BUIDL fund alone held over $2.5 billion as of late May 2026.

Who verifies that Bybit actually holds the reserves it claims?

Hacken, an independent blockchain security auditor, has verified Bybit’s reserve snapshots monthly since June 2024. During the February 2025 hack, Hacken publicly reaffirmed in real time that Bybit’s reserves still exceeded its liabilities, based on its ongoing audit access.