One year after North Korea's Lazarus Group executed the largest cryptocurrency heist in history—$1.5 billion drained from Bybit in a single afternoon—the crypto industry is confronting an uncomfortable truth: it has built a $3.7 trillion asset class on custody infrastructure that nation-states ca...
"Eighty-nine percent of the stolen assets remain traceable, but traceability is not the same as recoverability." — Ben Zhou, CEO, Bybit
One year after North Korea's Lazarus Group executed the largest cryptocurrency heist in history—$1.5 billion drained from Bybit in a single afternoon—the crypto industry is confronting an uncomfortable truth: it has built a $3.7 trillion asset class on custody infrastructure that nation-states can defeat with a compromised laptop. The Bybit breach was not an isolated failure. It was a stress test that exposed systemic fragility across the entire digital asset custody stack, from multisignature wallet interfaces to developer supply chains.
The numbers paint a stark picture. In 2025, crypto-related theft reached $3.4 billion globally, with North Korean actors responsible for $2 billion of the total—a 51% year-over-year increase that pushed Pyongyang's cumulative haul to $6.75 billion. January 2026 opened with $400 million in losses across 40 incidents, and the pace has not relented. Meanwhile, the TRM Labs 2026 Crypto Crime Report identified $158 billion in total illicit crypto flows in 2025, a 145% surge that reversed a multi-year decline. The industry's response has been a custody arms race: BitGo went public on the NYSE in January, Citigroup is launching institutional bitcoin custody this year, and Morgan Stanley is rolling out spot crypto trading to 5.6 million E*TRADE accounts. But the deeper question remains whether the security architecture itself is fit for purpose.
On February 21, 2025, Lazarus Group hackers compromised a developer machine at Safe{Wallet}, the open-source multisignature platform used by Bybit for cold storage management. The attack vector was not a smart contract exploit or a brute-force cryptographic break. It was something far more prosaic and far more devastating: a supply chain attack on a user interface.
The hackers injected malicious JavaScript into Safe{Wallet}'s front-end code. When Bybit's authorized signers initiated what appeared to be a routine transfer from their Ethereum cold wallet, the UI displayed a legitimate transaction. Behind the screen, the signers were approving a manipulated payload that replaced the wallet's implementation contract via a delegatecall—a Solidity feature that lets a contract execute external logic while retaining control of its storage. The malicious contract introduced sweepETH and sweepERC20 functions, enabling the attackers to drain over 400,000 ETH without triggering additional multisig approvals.
The sophistication of the attack—and its speed—stunned even veteran blockchain forensics teams. Within 48 hours, $160 million had been laundered through decentralized exchanges, cross-chain bridges, and Bitcoin mixers. The FBI attributed the attack to "TradeTraitor," confirming Lazarus Group's role. As of the latest available data, 88.87% of the stolen funds remain technically traceable, but only 3.54% has been frozen and a mere $30 million recovered. Some 7.59% has already disappeared into the dark web. Bybit's $140 million LazarusBounty program—offering 10% of recovered funds to on-chain investigators—has paid out $2.3 million to 13 bounty hunters. The numbers speak for themselves: tracing stolen crypto is not the same as getting it back.
The deeper lesson is that multisignature wallets, long considered the gold standard for institutional custody, protect against key compromise but not against interface manipulation. When the signing UI itself is the attack surface, every signer is blind.
The Bybit heist was the headline, but the underlying trend is more alarming. According to Chainalysis, total crypto theft in 2025 reached $3.4 billion across more than 300 incidents. North Korean actors accounted for roughly 59% of the total, executing 47 attacks that collectively netted $2.02 billion—a record that pushed the DPRK's cumulative crypto theft past $6.75 billion.
But theft is only one dimension of the crisis. The TRM Labs 2026 Crypto Crime Report revealed that total illicit crypto flows in 2025 reached $158 billion, a 145% increase from the $64.5 billion recorded in 2024. The surge was driven by three forces:
The year 2026 opened with no reprieve. CertiK data shows $400 million stolen in January alone across 40 incidents. A single phishing attack—an impersonation of Trezor customer support that tricked a hardware wallet user into revealing a recovery seed phrase—accounted for $284 million, or 71% of the month's losses. February saw a relative lull at $26.5 million across 15 incidents, but the trajectory is clear: attack sophistication is outpacing defensive innovation.
The Bybit breach catalyzed an industry-wide reassessment of custody architecture. The attack exposed a fundamental limitation of multisignature wallets: they secure the key layer but leave the presentation layer—what signers actually see and approve—vulnerable to supply chain compromise. This has accelerated the migration toward Multi-Party Computation (MPC) custody, which distributes key generation and signing across multiple independent parties without ever assembling a complete private key in one location.
MPC eliminates the single-point-of-failure problem that multisig was designed to solve, but does so at the cryptographic layer rather than the smart contract layer. Under MPC, threshold signature schemes (TSS) create independently held "shares" of a private key. No single participant—and no single machine—ever holds enough information to sign a transaction unilaterally. Critically, MPC is chain-agnostic, meaning it works across any blockchain without requiring protocol-level support for multisig operations.
Fireblocks, the leading MPC custody provider, has emerged as the primary beneficiary of the post-Bybit flight to security. The platform now secures assets for more than 1,800 institutional clients, embedding staking, policy engines, and transaction screening directly into its MPC infrastructure. Competitors including Dfns, Cobo, and Safeheron are expanding their MPC offerings, while hybrid models—combining MPC for operational flexibility with regulated custodians for long-term cold storage—have become the institutional default.
The market data reflects the shift. The crypto custody provider market grew from $3.28 billion in 2025 to $3.69 billion in 2026 and is projected to reach $7.74 billion by 2032 at a CAGR of 13%. The broader digital asset custody market, including software and infrastructure, is forecast to reach $7.4 billion by 2033 at a 29.5% CAGR.
Yet MPC is not a silver bullet. It protects against key compromise but does not solve the "what am I signing?" problem entirely. Malicious payloads can still be constructed if the transaction construction layer is compromised. The next frontier—already being explored by firms like Fireblocks and Fordefi—is hardware-enforced transaction verification, where signing devices independently parse and display transaction details rather than trusting any software-rendered UI.
Perhaps the most significant consequence of the security crisis has been the acceleration of traditional finance's entry into crypto custody. The logic is straightforward: if the industry cannot secure its own assets, institutions with decades of custody expertise and regulatory oversight will fill the gap.
BitGo's January 2026 NYSE IPO was a watershed moment. The company priced its offering at $18 per share, raising $212.8 million and debuting at a $2.59 billion valuation after a 24.6% first-day pop. BitGo is the first publicly traded pure-play crypto custodian, with custody and staking accounting for more than 80% of revenue. The company holds $104 billion in assets under custody, received OCC national bank charter approval in December 2025, and has never suffered a hack loss. Management projects $400 million in revenue and $120 million in EBITDA by 2028.
Citigroup plans to launch institutional bitcoin custody later this year, integrating crypto into the same custody, reporting, and tax frameworks it uses for traditional assets. The ambition is to make bitcoin "bankable"—flowing Bitcoin positions into the same reporting channels and tax workflows as equities and bonds, with cross-margining capabilities between digital and traditional assets.
Morgan Stanley is taking a broader approach, rolling out spot crypto trading on E*TRADE for its 5.6 million retail accounts while filing for Bitcoin, Ethereum, and Solana ETFs. The bank, which oversees roughly $8 trillion in assets, is also exploring wallet technology across its wealth management platform.
The Wall Street custody buildout reflects a structural shift in who the market trusts to hold digital assets. Crypto-native custodians innovated the technology; traditional banks bring the regulatory frameworks, insurance backstops, and operational controls that institutional allocators require. The question is whether this convergence raises the security floor for the entire industry or merely creates a two-tier market where bank-custodied assets are safe and everything else remains exposed.
Viewed through webthreepedia's economic value framework, the security crisis reveals a massive hidden cost layer that the industry has systematically underpriced. Consider the numbers: $3.4 billion stolen in 2025 plus $17 billion in scam losses represents $20.4 billion in direct value destruction—roughly 1.5 times the blockchain sector's total identifiable on-chain revenue of $13.7 billion.
This means the industry's security losses now exceed its fee revenue. Every dollar of legitimate economic value generated on-chain is accompanied by approximately $1.49 in value destroyed through theft and fraud. This ratio is not sustainable and represents perhaps the largest single drag on crypto's path to economic self-sufficiency.
The custody market—at $3.69 billion—represents the industry's investment in preventing these losses. But the ratio of spending to losses ($3.69 billion in custody services versus $20.4 billion in theft and fraud losses) suggests the market is dramatically underinvesting in security infrastructure. In traditional finance, custody costs are embedded in brokerage and banking fees and represent a small but non-negotiable line item. In crypto, custody is still treated as optional overhead rather than foundational infrastructure.
North Korea has industrialized crypto theft. Lazarus Group's $6.75 billion cumulative haul funds the DPRK's nuclear and ballistic missile programs. The group executed 47 attacks in 2025 alone, accounting for 59% of all crypto stolen globally.
Multisig is necessary but not sufficient. The Bybit breach proved that securing keys is meaningless if the signing interface can be compromised. The industry's migration to MPC custody is accelerating but remains incomplete.
Security losses exceed fee revenue. The $20.4 billion in combined theft and scam losses in 2025 dwarfs the $13.7 billion in on-chain fee revenue, creating a negative economic value proposition at the ecosystem level.
Wall Street is filling the custody gap. BitGo's IPO, Citi's custody launch, and Morgan Stanley's trading rollout signal that traditional finance sees crypto custody as a growth business—and that the industry's native security infrastructure was not enough.
The custody market is dramatically underinvesting. At $3.69 billion, the global crypto custody market represents roughly 18% of annual theft and fraud losses—a ratio that would be unacceptable in any other financial market.
The crypto industry spent a decade arguing that decentralization and trustlessness eliminated the need for intermediaries. The Bybit hack—and the $20 billion in annual losses that accompany it—proved that argument wrong. Not because decentralization failed in theory, but because the human and operational layers surrounding cryptographic systems remain stubbornly vulnerable to social engineering, supply chain attacks, and state-sponsored warfare.
The custody arms race now underway—MPC replacing multisig, Wall Street banks entering the vault, the first crypto custodian going public—represents the industry's belated recognition that security is not a feature. It is the product. The institutions that win the next phase of crypto's evolution will not be the ones that build the fastest chains or the cleverest DeFi protocols. They will be the ones that solve the $20 billion question: how do you keep digital assets safe in a world where nation-states are the adversary?
For investors and allocators, the signal is clear. Follow the custody infrastructure. The era of "not your keys, not your coins" is giving way to "not your custodian, not your insurance." The economic value of crypto cannot grow faster than the security apparatus that protects it.