Bybit's AI Security Shield: How $300M in Crypto Scams Was Intercepted in Q4 2025
Key Takeaways
The arms race between crypto exchanges and fraudsters has entered a new, automated phase. As artificial intelligence fuels a wave of sophisticated impersonation scams and laundering schemes, platforms are under intense pressure to deploy equally advanced countermeasures.
Bybit, one of the world's largest crypto exchanges, now claims a significant victory in that fight. The company announced that in the final quarter of 2025, its AI-driven on-chain surveillance system identified, blocked, and helped recover approximately $300 million tied to suspected fraudulent withdrawals. The intervention directly protected more than 4,000 user accounts from losses.
This figure emerges against a grim backdrop: global crypto fraud losses are estimated to have ballooned to $17 billion in 2025, with AI-generated deepfakes and automated social engineering attacks driving much of the increase.
"We're moving from a reactive posture to a proactive disruption model," said David Zong, Bybit's Head of Group Risk Control. "The goal is to identify the pattern and cut off the exit route before the funds vanish into the labyrinth of cross-chain bridges and mixers."
Bybit's strategy hinges on a three-tier risk-control framework:
- AI-Powered Detection: Proprietary algorithms continuously scan transaction patterns across multiple blockchains, including privacy tools and cross-chain bridges often exploited by bad actors. The system analyzes wallet behavior and historical data to flag anomalies in real time.
- Human-Led Intervention: Upon detecting red flags, the system alerts Bybit's risk-control team. Analysts then review the transactions, contact affected users, and can pause withdrawals pending verification. If fraud is confirmed, funds are frozen and recovery procedures begin.
- Industry-Wide Prevention: Confirmed high-risk addresses are added to shared databases. Bybit collaborates with blockchain analytics firms like Chainalysis and TRM Labs to trace and freeze funds across decentralized exchanges and peer-to-peer networks. The company reports these partnerships have led to over $40 million in additional frozen assets.
The security push follows a defining crisis for Bybit. In February 2025, the exchange suffered a devastating $1.5 billion hack, widely attributed to North Korea's Lazarus Group. The breach, which involved a compromised Ethereum cold wallet, sent shockwaves through the market and triggered a sharp sell-off in Bitcoin.
In response, Bybit has framed its AI and monitoring expansion as part of a comprehensive rebuild. The Q4 2025 results are presented not merely as damage control, but as a potential blueprint for an industry grappling with automated crime. The exchange also reported securing $4.32 million in frozen assets for 335 individual fraud victims during the quarter.
For an ecosystem still rebuilding trust after a series of high-profile collapses, the implications are clear. Security is no longer a back-office function but a core competitive strategy. Exchanges that fail to keep pace with the automation of crime may find themselves—and their users—irreparably exposed.
User Reactions
Marcus Chen, Crypto Investor (Singapore): "This is the kind of transparency and proactive defense we need. The $300M figure is staggering, but it shows the scale of the threat. If exchanges don't invest in this AI arms race, user funds are just sitting ducks."
Dr. Eleanor Vance, Cybersecurity Professor (MIT): "Bybit's layered approach—AI detection plus human oversight—is conceptually sound. The real test is scalability and false-positive rates. Over-blocking legitimate transactions could be as damaging as a hack to user trust."
"Crypto_Skeptic," Online Commentator: "Oh, fantastic! They lost $1.5 BILLION of user money in one go last year, and now they want a parade for 'saving' $300M? This is crisis PR 101. Forgive me if I don't applaud a bank for putting a lock on the vault after it's been emptied."
Arjun Patel, Fintech Analyst (London): "The collaboration angle with other analytics firms is the most significant part. Fraud is cross-platform, so defense must be too. This could push the industry toward a more unified security standard, which is long overdue."